INFORMATION TECHNOLOGY PART 6: PREPARING FOR DISASTER

The last article on information technology (part 5 in this series) addressed the issues of hacking and ransomware. The article discussed some, but not all, of the causes. This time we will look at some of the other causes, and the main issue a business may face regardless of the cause: disaster recovery.

As with all of these articles in The Micromobility Reporter, be aware that there is no guarantee your company won’t suffer an attack or data loss. Hopefully, some of the processes and tips in these articles will help stave off an attack or minimize the disruption.  

Hacks and ransomware as discussed are primarily initiated by individuals or groups seeking recognition and/or monetary gain. Just this week The Wall Street Journal reported that a ransomware attack believed to have been instigated by North Korea targeting healthcare providers and hospitals, was disrupted by law enforcement. Recall in the last article on this subject, I wrote whenever you have evidence of a hack or a ransomware demand, or you think you or your business have been targeted, you should alert the authorities. In this instance, because law enforcement was looking, not only was the attack stopped from impacting others, but a significant amount (about half a million dollars) of paid ransom in cryptocurrency was recovered.

State actors are the top end of hackers, and represent the most sophisticated of external threats to your systems and data. There are also internal threats that may not be as malicious, but can cause as much damage. I’ve already written about employee sabotage. This may come about in a number of ways such as being passed over for a promotion, getting mad at a supervisor or the owner, attempting to prove a point, or an employee taking action to gain access because they believe it will make them more efficient. An employee can lose or compromise data or provide system information to people outside the business, allowing them access to hack or encrypt data. All the more reason. This is why it is important to compartmentalize systems access and use tight password control.

On the other hand, people make innocent mistakes which an employee could do at any time. A mistake is just that, but whether data is lost or compromised, whether it happens maliciously or by mistake, it’s still a problem.

Another thing that can cause data or system issues is hardware and/or software failures. An earlier article mentioned the importance of making sure software updates are installed in a timely manner. It is also important to make sure your system hardware is appropriate to the software requirements. A correct correlation between software and hardware is essential to insure the software can function correctly, and that the suite of systems your business uses can interface and communicate necessary data effectively. When your business upgrades one, make sure upgrades to the other are considered and implemented as needed.

One set of potential problems that tends to be overlooked are natural disasters. Depending on where your business is located (or perhaps with multiple locations), you may be exposed to tornados, wildfires or facility fires, floods, hurricanes, earthquakes, or any combination. You may have some control concerning most of the threats I’ve written about in this and the previous article. However, natural disasters are completely out of your control, and may occur when you least expect them. Nonetheless they are real, and can cause just as much damage as a malicious attack.

Finally, a power surge or outage can do significant damage to hardware. Either could have a detrimental effect on your data and systems as well. Depending on the severity of the surge or the length of an outage, hard drives or other internal hardware devices may suffer failures, making data retrieval difficult to impossible. This scenario brings into focus the previous article in this series talking about backups. Hardware failures often do not allow for data recovery, so a backup could be the only way to restore your data.

For each of these possibilities the best defense is a good offense. Understand the systems used to run and manage your business. Take the time to find out how much data your business has generated. Initiate system user and password protocols to compartmentalize systems access for your employees, and manage how passwords are created. Make sure your data is backed up regularly and with multiple copies. And when disaster strikes, make sure you have a recovery plan.

Recovery failures happen most often because there is no plan in place. Talk with your system administrator to develop a plan to address these multiple threats. In fact, you may need to develop multiple plans, one for reach type of threat. The plans should be documented and updated as your systems, hardware and personnel change. The plans are important, but the planning process is even more so. An out of date plan that won’t work is of no help.

The plans should be simple and straightforward. They should be threat specific, and the steps should have a logical progression. They should be flexible to allow adjustments as a threat that may morph during an attack.

With proper planning, you and system administrator should hopefully be able to minimize any disruption in your systems and protect/restore your data with minimal downtime.

Feedback? Contact Steve Bina: steve@humanpoweredsolutions.com.