 |
Data Protection and Recovery Handbook |
Data Loss Prevention for Business UsersBusinesses that are dependent on their computer system to function need to make a "business continuance plan." There are consultants and companies that specialize in this discipline if you have sophisticated needs requiring outside help. At the core of any such plan is a list of activities and resources that your business cannot be without in order to function. If you experience an emergency such as a server crash or a complete disaster, how will you keep operating? A careful reading of this data emergency guide will yield many of the ideas you will need in your own business continuance plan.Issues that particularly apply to businesses include the use of centralized servers to backup individual workstations and the need for archival (long term) storage of frequently changed data such as accounting records and databases. BackupFor corporate mission-critical data, this means setting up a structured backup procedure, whereby a complete copy of all files (or sometimes just specific data files) is made, usually on a tape cartridge, and storing it off-site. Some procedures call for "incremental backup" of only the changed files, interspersed with periodic complete backups. This procedure calls for a strict rotation of clearly labeled tapes that supports a smooth restore procedure should it be necessary. Particular attention should be given to the type of backup software used to ensure full compatibility with your operating system and applications. (Learn more about backup strategies and tips.)RestoreAny formal backup routine should be tested by a "trial restore" during the normal course of operations. If you cannot afford to risk any downtime with the system in question, try to restore the contents of that system onto an alternate or spare system. (If your application is mission-critical as this implies, then you should be maintaining an alternate in any case. See "redundancy" below).RedundancyFor the largest corporations with huge financial resources, redundancy means maintaining an alternate and remote data center with an up-to-the-minute copy of the corporate application and data. A fail-over process will automatically route all data processing activities to the alternate center during an emergency.If your business is dependent on its computer system to function, then you need to make an investment in redundancy as part of your business continuance plan. For example, a small business will often re-purpose an older server as a workstation. Can you restore a backup to this computer and use it as the main server for a short period? A good contingency plan will identify a work-around or backup for each mission critical part of your business system. |
SecurityBusinesses must consider both internal and external security threats of both a physical and soft (logical) nature.Internal and external physical threats should be addressed through fire and flood proofing, and limiting access to various facilities with a high level of security surrounding a separate server room or data center. External logical threats can be mitigated through the use of hardware and software utilities such as firewalls and virus protection. (Learn more about virus protection and security threats.) Internal logical threats should be addressed through a comprehensive password system that assigns access rights by function. The system should be rigorously maintained and tested periodically. Human ResourcesEach organization should designate one or more individuals with the prime responsibility for data security and business continuance. This person should:
Effects of Data LossIf they are unlucky or careless, a personal user can lose countless hours of work or "priceless files" such as photos that have a high sentimental value.For the business user, the costs can be much higher and even become a life or death issue for that business. And if a data loss situation does not actually kill a business, studies show that downtime costs could be in the thousands or millions of dollars per hour. The long-term storage, maintenance and ability to use original data are formal regulatory requirements or at least a fiduciary or ethical duty in many fields. This is especially true in government, medical and financial environments. |