Redstor recently attended an Information Security and Risk Management conference and we wanted to share some of those discussions and thoughts with you. This article discusses ‘Threats’, where they might come from and what you might be able to do to mitigate the risks they represent.

Firstly, let’s consider a few threats. In each of the scenarios below, a vulnerability has resulted in a serious risk to your business

• A hacker obtains access to your website and remains undetected until the damage has been done. Maybe they have maliciously updated something on the website creating misinformation or they have defaced it to deliberately generate negative public opinion
• Attacks have resulted in your internal and external communications getting blocked, or perhaps your domain name has become blacklisted
• Multiple hardware failures or even a single hardware failure (in an infrastructure without resilience) is exacerbated by the lack of an up-to-date DR plan to provide fast and efficient recovery
• You recently discovered that a disgruntled employee who left the company a few weeks ago used their high access privileges and deleted or updated some critical internal data
• An environmental problem (e.g. flood, fire, power failure) means you have no access to your server room, and all the kit is powered off

The above list is far from exhaustive but illustrates that businesses face a wide range of threats from many angles.

In order to try and prevent threats from resulting in disastrous consequences for your business, here are three areas you should review, consider and action if you haven’t already done so.

1. Prevent
2. React
3. Plan

Try and prevent attacks in the first place by utilising network and software technologies that detect and block threats while allowing appropriate traffic to proceed with minimal performance impact. This is an area that most of us have already thought about and implemented. Firewalls, proxy servers, spam filters, web filtering and isolated DMZ’s to name a few.

Next, consider how you would react to these threats if they were to actually happen? Are you able to rollback your applications and critical data or restore entire systems? Maybe you can go back to last night easily, but what if you need to go back 3 weeks? Is that data residing on some tapes in an offsite location? How quickly can you get those back and then reinstate the systems as they were before the incident?

Plan for the worst but hope for the best. Have you got copies of all your critical servers, services and data in an offsite location, away from the incident? If so, have you tested that you can actually recover that data? Is it part of your regular DR tests, or do you not even have an up-to-date Disaster Recovery plan?

If you utilise cloud services, question your cloud provider to discover their thoughts on all of the above. Do they have active ISO 27001 Information Security Management processes in place? If you use a cloud backup service, ask whether they provide DR services as well as backup services? Can they provide advice on how to get a DR plan created and tested with robust processes?

Redstor prides itself on being experts in the backup, storage and recovery space and would be happy to assist you in reducing the risk to your business. Our range of services includes 100% UK-based online backup, unified endpoint management, on-premise IT solutions, file sync and share and cloud disaster recovery.