Forget the fires and floods: Mundane disasters pose the greater risk to your IT systems

Few words strike as much fear into the hearts and minds of IT professionals as “disaster”. They’ll swear six ways from Sunday that they’re prepared, that their disaster recovery plan (DRP) is up-to-date, that they’ve infinitely scenario-tested, that the company that relies on their thorough preparation can rest easy. Don’t believe a word of it. For generations, we’ve all had a certain definition of the word in our minds. That definition, unfortunately, is inadequate. We typically view disasters as big, epic events like raging fires, massive floods and devastating earthquakes. The average DRP is built around the kind of physical, visible, natural disasters that Hollywood directors have always loved. But what if the precipitating event isn’t caused by Mother Nature? And what if it isn’t visible at all? That’s a growing risk as the economic downturn continues to change how organizations – the ones that survive, anyway – run their day-to-day operations. The threat matrix is evolving, and relying on a DRP written five years ago after your CIO watched the Towering Inferno on DVD is inadvisable. Four major trends are at play here: • Layoffs are leaving fewer people behind to do the work. • Rising levels of automation may be helping resource-thin organizations do more with less, but they’re also making it easier for potentially catastrophic issues to go unnoticed until it’s too late. • Increasing mobility takes data that used to reside exclusively on protected systems and flings it around the globe on often vulnerable public networks and exposes it to end-users who may not give it the tender loving care it deserves. • Online crime is rapidly becoming a growth industry as business-savvy hackers figure out efficient ways to steal data and generate huge profits for themselves in the process. What this means for the average business is scarier than the biggest fire you can imagine. In a traditional disaster, your building may need to be replaced and your employees may need to work out of home offices and coffee shops for a while. But that’s more of an inconvenience than a major threat to your survival. More ominously, what would you do if your data disappeared because a badly configured sync process wiped out every copy of a mission critical database? What if you failed to stop the carnage before it was too late because you weren’t monitoring your automated systems? It’s exactly what happened to a friend of mine. Faced with a declining client base, he closed his remote office, laid off staff and moved his main business application to a mobile platform to allow his remaining skeleton staff to be more productive and responsive. His sole IT staffer set up an elaborate data synchronization process before he, too, joined the unemployment line. When that syncing process suddenly failed and mysteriously wiped out every working copy of the customer database, my friend was suddenly faced with a virtually complete data loss, and no apparent means of recovery. He wrongly assumed synchronization was the same as backing up. With no one minding the automated store, he wasn’t aware he had a problem until he logged in on his mobile device and saw nothing. When I asked him if his DRP was close by, he dejectedly confirmed it had no provisions for recovering from sync failures. He had defined the term disaster too narrowly and failed to prepare for potential recovery scenarios. So let’s recap: there was no fire, no earthquake, nothing overtly disastrous that would suggest my friend’s business was about to join the 60% of companies that are at risk of permanent closure within six months as a result of a total data loss. His DRP had natural disasters covered. Unfortunately, natural disasters are responsible for only 1% of all data loss incidents. He rapidly automated his IT capabilities as he reduced his staffing complement, then failed to give them sufficient visibility into routine data operations. How many other organizations, focused on surviving the market chaos and scared out of their wits by the endless flow of bad economic news, find themselves in the same boat? How vulnerable are they because they’ve failed to anticipate the new generation of invisible threats that can destroy data and cripple them without warning? Based on conversations I’ve been having with organizations across the market spectrum, I fear most of them are just as exposed, and that they’ve failed to protect themselves against issues such as identity theft that even a couple of years ago were less insidious than they are now. For organizations that have yet to suffer the consequences of this new breed of silent disaster, now is as good a time as any to crack open the DRP and get ahead of the curve.

Forget the fires and floods: Mundane disasters pose the greater risk to your IT systems

News | 03/23/2009 7:27 pm EDT

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us