INFOGRAPHIC: A Comparison of Business Continuity & Disaster Recovery

Business Continuity

Disaster Recovery

Definition

Business Aspects

1. Risks that can be avoided completely;
2. Any risks that you can not avoid but can mitigate to a greater or lesser degree;
3. Risks that cannot be avoided or even mitigated, and need to be dealt with as and when they happen.

BC is more strategic and looks at sorting and prioritising risks, and pre-emptively avoiding or reducing risks.

Disaster recovery plans usually include a ‘playbook’ of specific actions or step-by-step procedures to initiate under specific circumstances.

DR leans more towards handling risks that could only be mitigated (e.g. DDoS attacks, or nation-state attacks) or those that cannot be avoided at all (e.g. flooding or fire).

Risk Factor #1

Cyber Security

The world we live in today is filled with cyberattacks that are well documented in the media. Large organisations have experienced well-publicised breaches in their servers over the past few years.

Theft of data

The increase in remote working has resulted in a lot of sensitive corporate data being accessed from employees’ personal devices which can be ‘accidentally’ shared or accessed by unwanted parties.

Risk Factor #2

Physical security

The general rule is to know what you’ve got! You can’t secure something you don’t know you have. From video surveillance to fire alarms – you need to fully know your physical security system. If disaster strikes, it’s important to check and test all physical securities for future proof.

Viruses

The most common culprit behind massive data loss remains viruses from email. Having data backups is crucial in this sense. That way, you can at least ensure you have data recovery systems capable of restoring any lost or compromised data.

Risk Factor #3

Economic and financial risks

675,000 businesses have fallen victim to fake invoice fraud in the UK*. Businesses need to raise their standards in their financial risks to put in place policies, tools and systems to enable business continuity following large-scale data theft or loss.

Malware and ransomware

Malware is growing year on year and can affect systems, backups and storage. Should an organisation be subject to ransomware, one decision a company must make is whether to pay the ransom. Many cyber insurance companies will cover this cost, but are these questionable practices in an ethical sense?

Risk Factor #4

Compliance

Compliance and risk systems are often deprioritised within the business continuity plan. However, industry regulators are now fining companies for non-compliance, regardless of the disruption and costs that organisations are already facing.

Cyber-attacks

Identify what is lost and the extent of the damage. What was attacked, which controls failed? A post-incident report will expose the root cause, what was affected, and the extent of the damage. This will ensure no other vulnerabilities are at risk.

Risk Factor #5

Unsecured networks

Unsecured networks often lack any sort of protection and any information transmitted across the network is unencrypted for someone to hack. Should your system be attacked on an unsecured network, the main aim is to ensure that a network is restored to its normal state as rapidly as possible.

Natural disasters and pandemics

Fire, floods, COVID; all should have a backup plan to recovery. Whether that’s a remote desktop, a cloud backup or a virtual machine to work on. Your natural disaster recovery plan should be up to date, practised, and subject to regular testing.

Risk Factor #6

Accidental deletion of data

We’ve all been there. Most cloud storage systems will back this up as well as virtual machines giving you a machine’s entire configuration state, which can be reverted back to if needed.

Reputation

By having documented business continuity plans during the recovery process, it is easier for an organisation to manage user sentiments during a hacking incident.

Risk Factor #7

Human error

Human error accounts for nearly half (47%) of all major IT disaster recovery mistakes. Your employees are your first line of defence, yet many companies fail to train their staff in their security responsibilities.