Business Continuity and Disaster Recovery: Keeping the Organization Running
By: Heather Lange-Wilson
Cybersecurity is not only about preventing unauthorized
access.
It is also about making sure critical services remain
available when something goes wrong.
A ransomware attack, equipment failure, power outage,
natural disaster, network outage, or human mistake can interrupt operations.
Organizations therefore need plans for continuing essential
operations and recovering technology.
Business Continuity
Business Continuity Planning (BCP) focuses on
maintaining essential business operations during a disruption.
The central question is:
How do we continue operating?
This may involve:
- Alternate
work locations
- Manual
procedures
- Backup
communications
- Redundant
systems
- Emergency
staffing plans
- Prioritization
of critical services
Disaster Recovery
Disaster Recovery (DR) focuses more specifically on
restoring technology and systems following a disruption.
The question becomes:
How do we restore our systems and data?
Business continuity and disaster recovery work together but
are not identical.
Business Impact Analysis
A Business Impact Analysis (BIA) helps identify
critical business functions and the consequences of disruption.
Organizations may evaluate:
- Critical
processes
- Dependencies
- Financial
impact
- Operational
impact
- Maximum
acceptable downtime
- Required
resources
The results help prioritize recovery.
Recovery Time Objective
Recovery Time Objective (RTO) describes the targeted
amount of time within which a system or process should be restored after a
disruption.
If a system has an RTO of four hours, the recovery strategy
should be designed around restoring the service within that target.
Recovery Point Objective
Recovery Point Objective (RPO) addresses acceptable
data loss measured in time.
If an organization has an RPO of one hour, its backup and
recovery strategy should generally support recovering data to a point no more
than approximately one hour before the disruption.
An easy way to remember:
RTO = Time to restore
RPO = How much recent data can be lost
Backups
Backups are essential, but simply having a backup is not
enough.
Organizations should consider:
- Backup
frequency
- Storage
location
- Access
controls
- Encryption
- Offline
or isolated copies
- Restoration
testing
A backup that cannot be successfully restored provides
little protection.
Redundancy
Redundancy reduces dependence on a single component.
Organizations may implement redundant:
- Internet
connections
- Power
supplies
- Servers
- Storage
- Network
devices
- Data
centers
Redundancy improves resilience but does not replace
planning.
Exercises and Testing
Plans should be tested before an emergency.
Organizations may use:
Tabletop exercises - Participants discuss how they would respond to
a scenario.
Simulation exercises - Participants practice aspects of an emergency
response.
Technical recovery tests - Systems or backups are restored to verify
recovery capabilities.
Testing often identifies assumptions or missing information
that would otherwise remain undiscovered until a real emergency.
Employee Responsibilities
Employees should know:
- How
emergency communications will occur
- Where
to report during a disruption
- How to
access approved alternate systems
- Which
manual procedures may be required
- Who to
contact for assistance
Employees should avoid creating their own unauthorized
workarounds during an outage.
Security requirements still matter during emergencies.
Knowledge Check
1. What does BCP primarily focus on?
A. Maintaining essential operations
B. Password creation
C. Software licensing
D. Phishing simulation
Answer: A
2. What does RTO measure?
A. Targeted time for restoring a service
B. Password age
C. Number of backups
D. Data classification
Answer: A
3. What does RPO help define?
A. Acceptable data loss measured in time
B. Number of administrators
C. Firewall rules
D. Audit frequency
Answer: A
4. Why should backups be tested?
A. To verify they can actually be restored
B. To make files larger
C. To avoid encryption
D. To eliminate continuity planning
Answer: A
Security+ Quick Review
BCP = Keep critical operations functioning
DR = Restore technology and systems
BIA = Determines impact and identifies critical
functions
RTO = Target restoration time
RPO = Acceptable data loss measured in time
Tabletop Exercise = Discussion-based practice of a
scenario
Final Takeaway
Resilience is not simply having backups.
Organizations need to understand what is critical, how
quickly it must return, how much data loss is acceptable, and what employees
should do while recovery is underway.
