Backups protect data, but business recovery depends on restoring critical services, trusted data and operational capability.
Cyber recovery requires clear business priorities, clean recovery environments and resilient infrastructure.
Security, storage and data centre experts from Datacom explain the importance of trusted data, recovery infrastructure and testing.
Successful backups can provide confidence that data is protected, but genuine recovery readiness depends on whether an organisation can restore the services its business needs, reestablish trust and access the infrastructure required to get operating again.
For many organisations, confidence in recovery starts with a familiar set of indicators: backups are running, disaster recovery plans are documented and redundant infrastructure is in place.
The problem is that none of these things, on their own, prove that the business could recover from a significant disruption.
A cyber incident can make that gap particularly apparent. Even with a successful backup, an organisation may need to establish whether its data is clean, whether systems or credentials have been compromised, which business services need to return first and where critical workloads could run if the existing infrastructure is unavailable.
These were among the questions explored by security, storage and data centre experts from Datacom and Dell Technologies in the recent webinar Beyond backup: rethinking storage for recovery and resilience.
Datacom Associate Director of Strategy Daniel Bowbyes began the conversation by challenging organisations to look more closely at what they actually know about their ability to recover.
“Modern cyber incidents have shown that having backups doesn't necessarily mean you can rebuild operations, restore trusted data or access the infrastructure capacity needed to recover within an acceptable time frame.”
One of the clearest themes from the discussion was that recovery planning needs to start with the business rather than a list of applications.
Datacom Director of Security, Networks, Automation, AI and Project Services Adam Kirkpatrick describes this through the concept of the minimum viable business: deciding what an organisation absolutely needs to be able to do the morning after a serious disruption.
That requires input from the people who understand how the organisation actually operates. So in a hospital, for example, the IT team should not decide in isolation which services matter most and need to include the clinical teams in establishing those priorities.
Without that agreement, every business function can make a legitimate case for why its system should be restored first. The technical recovery team is then left trying to resolve competing priorities during an already difficult incident.
Kirkpatrick says the distinction between IT recovery and business recovery is important.
“Getting a system back online is a milestone. That's the first milestone, but getting a business working properly is actually the goal.”
This also exposes dependencies that may not be obvious when recovery plans are organised around individual applications.
A priority application might depend on identity services, DNS, certificates, encryption keys or network services. A business process may rely on a supplier or another seemingly minor system that was never considered critical. The system everyone wants restored first may therefore be fifth or sixth in the technical recovery sequence.
That complexity becomes greater after a cyber incident because the starting assumption might be that the existing environment can no longer be trusted.
Traditional disaster recovery is often about restoring something that has failed. Cyber recovery adds the need to establish whether data is clean, whether systems have been altered, how the attacker gained access and whether something malicious could return with the restored environment.
Dell Technologies Senior Cyber Resilience Systems Engineer Dave Williams says this has changed the way organisations need to think about protecting recovery data.
Immutable storage can prevent a protected copy from being changed during its retention period. But the strength of that protection depends on how immutability is implemented and whether compromised production credentials or systems can still reach it.
Williams puts the principle succinctly: “Immutability is good. Isolation and immutability is better.”
Separating critical recovery data from the production environment can provide another layer of protection when trust in that environment has been lost.
The same thinking applies to recovery itself. Restoring data into another environment does little good if an organisation simply carries the original compromise with it. Recovery planning therefore needs to account for how trust will be established before systems and services return to operation.
Having trusted data is one part of the equation but organisations also need somewhere to run it.
Mac Lewis from Datacom’s data centres team says the infrastructure picture has become more complicated as organisations have moved towards hybrid and multi-cloud environments.
Recovery may involve physical data centres, private and public cloud services, networks, suppliers and customers. Connectivity and latency can become just as significant as storage and compute capacity when organisations are trying to restore a functioning service.
Lewis argues that infrastructure needs to be considered when applications are designed and modernised, rather than towards the end of the process.
“I kind of feel that this is a whole integrated architecture that needs to be considered when building and designing right up front.”
That extends to clean recovery environments and sovereignty: where data and applications reside, who owns or controls the underlying infrastructure and how recovery environments connect into the wider organisation can all influence the architecture required.
Capacity is another consideration – if production infrastructure is unavailable, replacement storage and compute may not simply be available on demand. Longer supply lead times can make sourcing significant amounts of hardware after an incident impractical.
Organisations therefore need to understand the minimum infrastructure required to operate critical services and decide beforehand how that capacity could be accessed.
The thread running through the webinar was the importance of testing. A recovery plan can look comprehensive until it meets the dependencies, people and operational constraints of a real incident. Assumptions that seem reasonable on paper can break down quickly when a team discovers it cannot authenticate to a system, a forgotten workflow is preventing a critical process from running or the person authorised to approve an action is unavailable.
The panel's advice is to break things down to make the problem manageable. Rather than attempting to prove the recovery of everything at once, Kirkpatrick recommends starting with one important business service and following it all the way through.
“Test one critical business system right through to recovery. Let's keep it really simple. Get the right people in the room, let's play that scenario out, test it.”
That exercise can establish what the business needs, uncover dependencies, test recovery order and show whether the supporting infrastructure is actually available.
It also gives organisations something more useful than confidence: evidence.
As Bowbyes observed at the end of the discussion, resilience is something organisations need to design, test and continually prove. Recovery plans will change as applications, infrastructure, suppliers and new technologies become part of the environment.
The important step is to start replacing assumptions with what you have tested and what you know will work.
Datacom’s Dedicated Storage as a Service offers dedicated Dell enterprise storage through a consumption-based model. It can be deployed on premises, within Datacom Tier III data centres across Australia and New Zealand or at a qualified third-party facility. The service can include 24/7 monitoring, incident management, capacity management, monthly reporting and Dell vendor liaison.
