When disaster strikes, what will you do?

How do you respond when faced with a disaster? Unfortunately, things such as cyber-attacks or natural disasters happen every day all around the world, often disrupting workflow of compromised companies and entities, and it often falls on a capable IT support system to save the day and the company or organization files. Because of this, any business must ensure that a protocol is put in place and measures are taken to avoid further injury to the company in case of disaster.

Ways to Ensure Against Disaster

• Backup and Recovery Solutions
  • The first thing to consider is that data may end up being lost, especially if the emergency situation involves a cyber attack on the company or a network it works through. It can be quite daunting to think of losing such vital information to your company’s workflow, but by planning ahead strategically and having a backup in place, no important data will be lost forever and can be retrieved. Additionally, security measures must be taken to safeguard the recovery backup by setting up encryptions to make sure that privacy compliance is met and no unauthorized access is granted. Make sure that automatic backups are periodically made to avoid losing any new information as it may come.
• “DRaaS”: Disaster Recovery as a Service
  • “Disaster recovery as a service” (DRaaS) is a service that works with the cloud that provides immediate backup recovery after a natural disaster or cyber attack has wiped or otherwise compromised and rendered unreadable confidential files. It is usually a paid service accessible once a disaster has been mass reported. These are scalable services which can be provided based on the needs and reach of the organization in question to be served. If a DRaaS system is used, it’s often best to check on the backup and make sure it is comprehensive and fits your company’s needs.
• Proactive resilience testing methodologies must be made regularly to test the system for any errors that can be fixed.
  • In addition to checking on and going over the DRaaS backup, it is important to schedule diagnostic tests to see how your company’s system would react in the case of a natural disaster. While resilience testing to indicate if there are any ready discrepancies in the backup system is good to start, it’s important to follow this with scenario-based testing, which will run a drill through the system. It is imperative to make sure that before such tests are done, every department within and connected to the company (including IT, finances, and private security) are aware of the testing taking place.
• Develop a good incident report and response system.
  • Similar to how it’s important to have a strong self-service portal when working in areas such as cyber security with sensitive information, it’s important to have this extended to the cyber security system and have any seemingly small error or discrepancy reported and investigated upon for a solution. One never knows if a small error in one area means a larger problem looming somewhere in the system code.
• Make sure regular employees are aware of the disaster scenario protocols.
  • In addition to making sure the IT and other departments are aware of how to handle backup and other services during disaster scenarios, it’s important to have this information readily available for the rest of the employees, up to and including informing them of any further testing so that potential tech delays will be expected if they arise. It would also help to inform employees of certain IT protocols that may end up becoming more visible during the average work day, including certain lag times and glitches that are being worked on.

How to Set Up a Tactical Business Response

A company must always exercise preventative measures and figure out how they would respond in event of catastrophe; in many ways, this is the only way their company will be able to achieve longevity and trustworthiness. How the company reacts and responds when faced with a natural disaster or cyber attack can spell how exactly it will fare during the attack as well as after.

One of the best methodologies for proactive resilience testing is creating what’s known as a red team exercise. A red team exercise is a careful form of scenario testing in which a “red team” of ethical hackers are hired to hack into the company and expose any weak spots in the security and firewall. There are no step-by-step guides for how to pull off a successful red team exercise, but here are some general things to keep in mind when scheduling one for future implementation:

1. Figure out what your objective is and what the scope of your company is. Who you end up hiring as your red team will need to know how large your company is and how many active users are on the network before setting up the test attack. Figuring out which part of the system will be affected as opposed to others can also be important depending on what parts of the system is being tested for vulnerabilities.
2. Decide on what the attack is meant to simulate. For example, if a natural disaster is chosen for the drill, it might involve accessing the network from a different terminal than the ones used at the main workspace. It’s important to plan ahead for such disruptions in the workflow.
3. Finally, it’s important to set up your red team, ideally from agents that have a background of cyber security compliance services. A high level of professionalism and ethics is crucial, as clearly a hacker could do a lot with some of the more sensitive information that could be floating around in a company’s hard drive. It’s important when assembling your red team that you background check every major player and have their contact information and any communications including work contracts at the ready in case things go south after the testing.

The most critical thing when it comes to disaster is response, and response involves proper communication. It’s best to make sure everyone is aware of how to carry out protocol.