Business Continuity and Disaster Recovery: Planning for When Things Go Wrong
Security teams work hard to keep threats out, but no defense is perfect. Sometimes an incident happens anyway. A breach can mean lost profits, lost customers, and a damaged reputation, so organizations need a plan for what to do next.
Think of it like a fire drill. Nobody expects a fire, but when one starts, you don’t want people improvising. Two plans handle this in security: the business continuity plan and the disaster recovery plan.
Where these plans fit: a four-part process
Most security teams follow four steps to protect an organization, and the continuity and recovery plans come last:
- Identify the assets that must be protected.
- Determine the threats that could harm those assets.
- Implement tools and processes to detect those threats.
- Create the business continuity and disaster recovery plans. This is usually handled by IT or the appropriate business function, and the two plans are made together.
Notice the order. You can’t plan a recovery for assets you haven’t identified.
The business continuity plan
A business continuity plan is a document outlining the procedures to keep business operations going during and after a significant disruption. Its goal is to limit damage like lost profits and customers.
There are four essential steps:
- Conduct a business impact analysis. Look at the possible effects a disruption of business functions could have on the organization.
- Identify, document, and implement recovery steps for critical business functions and processes. This gives the team actionable steps to respond to a security event.
- Organize a business continuity team. This brings together people from departments like cybersecurity, IT, HR, communications, and operations to carry out the plan if needed.
- Train the team. Training exercises walk through different risk scenarios so the team is prepared for real threats.
The disaster recovery plan
A disaster recovery plan outlines the steps the security team takes to minimize the impact of a security incident and resolve the threat. Imagine a ransomware attack that stops the manufacturing team from retrieving certain data. The disaster recovery plan is what guides the response.
Its steps include:
- Implementing recovery strategies to restore software
- Implementing recovery strategies to restore hardware functionality
- Identifying applications and data that might be affected after an incident
How they differ
| Business continuity plan | Disaster recovery plan | |
|---|---|---|
| Focus | Keeping the business running | Restoring systems and resolving the threat |
| Question it answers | How do we keep operating during and after a disruption? | How do we get our software, hardware, and data back? |
| Created | Alongside the other plan | Alongside the other plan |
Both aim at the same goal: minimizing the damage of a successful attack.
See recovery planning in action in my ICMP Flood DoS incident report.
Key takeaways
- Continuity and recovery plans are the final step of a four-part process: identify assets, determine threats, implement detection, create the plans.
- A business continuity plan keeps operations running during and after a disruption.
- A disaster recovery plan restores software, hardware, and data and helps resolve the threat.
- The two plans are created together and strengthen an organization’s overall security posture.
- Having plans in place means the organization keeps moving forward even when an incident occurs.