One of the telling consequences of these recent attacks has been the amount of time it has taken the businesses to get back online. Jaguar Land Rover for example took six weeks, only returning to full operations on the 16th October. Whilst some of this has been due to systems being shut down because of the breach and a loss of a data, it seems the lack of access to the company’s DR plans may also have been a contributing factor. The letters sent by the Government has urged companies to keep a copy of these plans on physical paper and to include how they can continue to operate offline.
Whilst moving some of this away from technology seems a sensible plan, gaining real-time risk insights to your business, what should be included in the offline plan and how it could work in a worst-case scenario is an area where innovative technology can still play a critical role as Matthew Davies, CPO at SureCloud explains.
"This ’back-to-basics’ advice from the Government is a reaction to the high-profile, hugely damaging breaches we have seen over the past few months. The results of these breaches have caused huge financial damage with businesses unable to stock shelves, take online orders or even open factories.
"Therefore, working out how the business can continue offline and what actions can be implemented in the worst-case scenario are now critical. Obviously, once compromised and systems have been taken down, either defensively by you or by the cybercriminal, if your plans are only stored digitally you are going to struggle to implement any kind of business resilience plan. Keeping a hard copy on paper to hand is sensible advice
"This though requires a lot of organisation and planning. Developing policies and workflows to help prioritise which are the right things to move to paper is now something most companies need to be thinking about and acting on.
"Think of it as almost a reverse to identifying the key data that can be moved to the cloud from a on-premise server. Not everything will work in the new format, you might not want to move everything and importantly, moving everything poses its own risk anyway. Some of the information regarding responding to a successful breach may need to be kept behind security walls online. Committing these to paper which are to be kept in the office poses a real risk of ending up in front of someone did not authorise to see it.
"Making these decisions and understanding what can and cannot be committed to paper is an area where technology should still be playing a crucial role. Innovative solutions can help companies through this process whilst making sure that any transference to paper does not place the company at further risk. Also, ensuring that any such move does not then place the company at risk of falling foul of regulations is an important consideration, that again Governance, Risk and Compliance (GRC) solutions can help companies with.
"Lastly, especially with compliance in mind, using technology to record the processes taken to adjust contingency plans will help to prove the efforts taken by companies to ensure that day-to-day business can continue even in the face of a successful breach.
"The Government’s advice may seem like a backwards step for some. However, seeing the struggles of companies compromised over the past few months, offline planning is a sensible part of any DR plan. However, this should not be seen as the start of a modern-day Luddite movement. Technology should still be playing an important role in helping put these processes in place and understanding what the risk to a business looks like," Davies concluded.
