It’s Time To Add Hacking Into Your Disaster Recovery Plans As A Potential Risk For Downtime

Right now, the internet probably seems like the Wild West.  Hackers are roaming around, seemingly attacking websites on a whim.  Most recently, groups like Anonymous, the Jester, and Lulz Security (LulzSec – now supposedly disbanded) have been attacking and successfully taking down web sites of all types.  Government and corporate, public and private, anybody seems as though they can be a target for these attacks.  While their reasons for attacking a site range from political statement to simply for the fun of it, hacktivists and black hat trouble makers alike, the end result is that hacking is now a real cause of downtime.

In the past, these groups operated on the fringe of the vast expanse known as the internet.  Their names were known mostly amongst communities that were already interested in their antics.  However recent events such as the Occupy movement, the SOPA/PIPA debates, and the protests in the Middle East have dragged these groups into the limelight.  Since then, their infamy has only grown with the combined Anonymous/LulzSec attack on Sony’s Playstation Network in 2011 which cost Sony $171 million in lost revenue alone (with some estimates placing the cost at a staggering $24 billion), the recent takedowns of the Department of Justice (DOJ), CIA and FBI websites, the recent attack on the NASDAQ, and now the most recent threat from Anonymous to effectively disable the internet, hacking is a very real, very present risk to consider. It is easy to simply dismiss these activities as random acts of tomfoolery, and even easier to assume that it will never happen to you but that is a dangerous and potentially costly notion. In my most recent report, “Building The Always-On, Always-Available Extended Enterprise”, I discuss the cost of downtime and show how costly a website outage can be for just a couple hours.  Whether you run an eBusiness website or not, the revenue and reputation damages of an outage can be astronomical.

When dealing with disaster recovery, most common causes of downtime are power outages, infrastructure failures, human error, and natural disasters.  But suffering a denial of service attack (DoS) is generally not in the forefront of leaders’ minds.  Whether it's an unintentional denial of service, like when Coca-Cola and Acura's websites crashed during the superbowl due to the popularity of their commercials, or a distributed denial of service attack by hackers, the difficulty is predicting the occurrence of, and protecting yourself against downtime.  As with any other disaster, it is important to have a disaster recovery plan in place in the case that such an event may occur.  These types of plans should focus on communications to employees and customers and any potential workarounds and methods to distribute additional information. You may never be able to prevent a DoS attack, but you can be ready if (or when) you are subjected to one.

[With contributions from Eric Chi]

Comments

Rachel: Nicely done. I

Rachel:

Nicely done. I believe too often when considering DR the customer focus is on flood, fire, earthquake, etc. Rarely is it, popularity of commercials taking the website down. Although the threat of hackers should always be in the forefront of every DR and BC professional's mind - your blog is a great reminder to consider all the risks and weigh them accordingly.

-Chapa

Great perspective. It is

Great perspective. It is refreshing to hear the storage and DR community expanding its viewpoints to consider the threats in the market. The days of treating storage, security, DR etc. as totally separate disciplines are long past. It takes a while for the org structure and planning teams to adjust to this in organizations but it is happening. One area I watch with interest is the evolving role of the CISO and Legal. E-Discovery and Compliance requirements have brought these leaders squarely into the data management discussions within IT/Storage. That's driving a new set of concerns that go well beyond dedupe rates and backup SLA's. The more data you have the more you need to protect. The more valuable your data the more outsiders want it.

Cheers,
Sean
@seanjregan

Great perspective. I agree

Great perspective. I agree that too often businesses forget that outage-causing disasters aren't just the natural kind - most downtime is caused by human error and then malicious intent. All the more reason to have a strong disaster recovery solution. @continuitycentr