Blizzards, ice storms, bomb cyclones, human error, and now COVID-19—natural disasters, including pandemics, can have a tremendous impact on the livelihood of any organization, especially during the winter months. And there’s no end in sight: Studies indicate that a warming climate may increase the frequency and intensity of natural disasters, and infectious disease experts say COVID-19 could continue to impact our way of life for the immediate future, heightening the risk for an interruption in business continuity. All organizations must prepare for the worst. Those that don’t run the risk of getting frozen out of their networks and potentially never fully recovering. But where to start?
For managed service providers responsible for ensuring the security of their customers, it’s imperative to invest in a rigorous business continuity plan. MSPs should start by working with their client to conduct a business impact analysis to identify potential events that could negatively impact normal business operations, calculate the likelihood that each event may occur, and quantify the impact that the event could have on their business. From there, MSPs can develop a robust strategy to address risk mitigation, disaster response, and continuity of operations.
Prepare for the Worst; Hope for the Best
No two disasters are the same, and there are a wide variety of threats to prepare for. For example, if a data center is located in Florida, the likelihood of a hurricane is high (during hurricane season) and the business could be negatively impacted in a big way if downtime is significant. Similarly, bomb cyclones are more common over warm ocean currents, and organizations in those regions must be prepared for the damage that follows flooding, white-out blizzard conditions, and hurricane-force winds.
Regardless of the disaster, it’s critical that MSPs prepare strategic plans for their clients to mitigate risk, and ultimately, downtime. In the event of a disaster, data backup solutions are not enough; it’s essential to be able to run applications on demand from virtual machines backed up in the cloud to ensure business continuity. The good news is that today’s data protection technologies and services have greatly improved the IT piece of the business continuity puzzle. A strategic business continuity and disaster recovery plan can help businesses avoid the cost of damages associated with getting back up and running after losing (access to) data, which was $136,396.61 on average in 2019.
To assist in their preparation, MSPs should share five basic mitigation essentials with their clients:
- Instant Virtualization: This allows clients to rapidly restore physical or virtual servers locally on a device or in the cloud. Now the client can resume normal business operations while its primary systems are restored. MSPs should recommend an option that does not require a file conversion when mounting a backup image. This will simplify and accelerate their recovery process. Since they can get back up and running directly because they are using the cloud, they will have an edge when local competitors cannot bounce back as quickly.
- Bare Metal Restore (BMR) with Fast Failback: BMR is a type of restoration tool for systems that need to be completely rebuilt from a backup. Many BMR tools require planned downtime to copy any changes that occurred while failed over to the virtual systems. This technology allows clients to continue running a server in a virtualized state while that data is copied over to the system being restored—eliminating costly downtime.
- File-Level Restore: If an end user deletes a small number of files, the client needs a fast way to retrieve them without performing a full restore. File-level restore capabilities need to be designed for granular recovery of files and folders so they can be remotely accessible via the web UI. The direct restore utility should be fully automated and allow them to restore one or many files, as well as metadata and settings.
- Rapid Rollback: Clients need a solution that performs a restore due to unwanted changes to a large amount of files; an unsuccessful operating system (OS) or application update, or a ransomware attack can present challenges. In these scenarios, a file-level restore can be a slow, manual process. A rapid rollback approach allows automated comparison checks between the existing system files and the backup to determine which should be restored, saving them time and effort.
- Roundtrip Service: Restoring a large amount of data from the cloud to client production machines can take days, weeks, or even months depending on the amount of data and the connection speed. To eliminate this issue, they need a system that exports their data set to a hard drive and overnights it.
Beyond Backup
Many organizations think they’re safe just because they have taken steps to back up their critical files. The problem is that those files depend on applications and systems if they’re to be of any use. For this reason, it’s essential to be able to run applications on demand from virtual machines backed up in the cloud in the event of a disaster.
Warning times are another detail MSPs and businesses can pay attention to when mitigating disaster. Though different disasters have decidedly different warning times, often they are clear and present, but not appreciated as a tool for reducing the impact of a disaster.
For example, water damage from failed plumbing can short-circuit electronic equipment with zero warning. However, building alarm systems typically give employees a few minutes to shut down critical systems and evacuate the premises, reducing the amount of damage to machinery and other casualties. The National Weather Service and other agencies typically issue advisory alerts, giving businesses 24 hours or more to prepare for an event. Even so, they are often ignored because storm paths are notoriously difficult to predict and result in false alarms. Yet hurricanes and coastal storms can wreak enough destruction to put a data center out of commission for a day, a week, or even permanently.
Clients rely on their MSPs not only as technology and services advisers, but also to fully understand and implement robust security strategies. As we’ve all learned recently, disasters can happen at any time, and the resulting downtime they can cause is truly catastrophic, leaving unprepared organizations incapable of recovery.
The best offense is a good defense; protect your clients’ businesses by understanding their vulnerabilities, safeguarding against risks, and preparing for the worst with a plan that will shield their data, protect their business, and keep their systems available and reliable no matter what happens. MSPs must assume control in order to ensure their clients are secure, and more importantly, that their clients’ businesses are protected should something unexpected occur.
RYAN WEEKS is chief information security officer for Datto.
