Many companies ask themselves what would actually happen if their data and applications were to disappear. What security requirements should you be able to impose on your supplier, and what should you as a company do to be able to recover after a disaster? You can find the answers to these questions here, from Johan Wedin, COO at Binero.
What does it mean for all the data stored and all the applications managed when a data centre burns down?
When the worst happens, it is important to have the right kind of backup solution and a plan for how to proceed. Unfortunately, simply having a backup can sometimes be insufficient, for example if it is stored in the same building as the primary data and the building burns down or collapses.
It is important to spread your risks by securing a backup solution that replicates all data to a secondary site, i.e. another data centre. The data will then remain intact in the event of a disaster at the primary site.
Is there any way to prevent such a total loss of data and applications? What requirements should customers place on their suppliers and solutions so that they don't have to worry?
A supplier should be able to offer all types of solutions for Disaster Recovery (DR), off-site backup and even High Availability (HA). The best solution depends on the requirements for availability, and DR solutions are often linked to data security requirements. In some cases – i.e. for certain applications or certain data – companies may be OK with it taking several days to recover from DR, as this is often linked to the cost picture.
For customers who want to go one step further, reserved primary operation may be an option. This means storage, compute and network at the secondary site, available to start up at any time. This means that in the event of a total failure, operations can be restored in a very short time.
It may also be relevant to consider so-called ‘active/active’ solutions. This concept involves running the entire platform redundantly from (at least) two data centres. In addition to allowing one side to be completely shut down without end users noticing, this solution also provides access to the performance of both sides during normal operation. It is also possible to perform maintenance on one side at a time, which is a major advantage for administrators.
What advice would you give to companies planning to put their data or applications in the cloud, or to rent space in a data centre through colocation?
Different solutions are suitable for different cases. This depends on the service you use, but also on how sensitive the data is and what your availability requirements are. Disaster recovery (DR) is not primarily about minimising risk, but rather about planning for and having a solution for the worst-case scenario, as well as being aware of how long it takes to recover after a disaster.
Putting your application in the cloud can be very secure, but also very insecure. Security can only be achieved if you and the service provider jointly evaluate the risks and availability requirements that exist, and based on this, agree on the design and choice of architecture. Choosing a provider that makes risk mitigation a natural step in the process will get you a long way, as it will enable you to prevent things like total data loss even if a disaster – such as a fire – were to occur.
If you have very high availability requirements, you should consider an active-active solution. If you don't, backups at other sites and a detailed plan for restoring your application may be sufficient.
It is important to identify risks and implement a solution that meets your requirements. These are some key questions to ask yourself:
- What level of risk is reasonable when it comes to ensuring that data remains secure?
- How long is it acceptable for operations to be down after a disaster?
- What level of complexity is acceptable, and is the necessary expertise available?
You should conduct a risk analysis at least once a year and definitely when major changes occur. In addition to considering whether your supplier and solution meet the requirements for functionality, capacity and connectivity, you should also look at aspects such as security, fire and perimeter protection, backup, DR, monitoring, and so on. Risks related to data integrity and regulatory compliance are also important to evaluate regularly.
