A backup alone does not bring operations back. After a major incident, many questions arise at once: Which systems are restored first, on which hardware, by whom, and how long will it take? Disaster recovery answers these questions in advance so that, in an emergency, people work from a tested plan instead of improvising.
How does disaster recovery work?
The foundation is an analysis of which systems are critical to the business and how long they can be down. This yields two target values per system: the tolerable data loss and the tolerable downtime, see RPO and RTO.
Depending on the target values, different methods come into question: restoring from backups onto replacement hardware, continuous replication of virtual machines to a second site that takes over in an emergency, or restarting in a cloud environment, often offered as disaster recovery as a service. The shorter the target times, the more complex and expensive the solution becomes.
The DR plan defines roles, communication channels, recovery order, and dependencies. For example, the directory service usually has to be running before applications can be used again.
Typical examples
- After a ransomware attack, systems are rebuilt in a clean environment from backups that the attacker could not modify, see immutable backup.
- Water damage in the server room requires central systems to be restarted at an alternate site.
- A faulty change corrupts a database, which is rolled back to a state before the change.
What companies should keep in mind
- Test the restore regularly, not just the backup; only a test shows the actual duration.
- Keep the plan available offline too, since file servers and email may not be reachable in an emergency.
- For cyberattacks, plan for systems to be cleaned and credentials to be renewed before restoration.
- Clearly name responsibilities and deputies.
How it differs
Disaster recovery focuses on restoring IT. Business continuity management is broader and looks at how the entire company continues its critical processes, if necessary in emergency mode without IT.
How TOMORIS relates
At TOMORIS, backup and recovery are offered as GRID.vault, a building block of GRID, the connected IT operations service.
View GRID.vault