Getting Started with Data Protection Planning

March 21, 2019

Data protection is the process of safeguarding important information from corruption, compromise or loss. In today’s environment, businesses are demanding faster recovery times than ever before. These demands are only achievable with a recovery plan that focuses on applications, not just data and servers.

A strong data protection plan will help ensure that the data and applications within your organization are properly protected and controlled. Planning will help to mitigate against ransomware attacks and limit attackers access to sensitive data.

As cyber attacks and other disasters continue to strike businesses, data protection planning continues to gain momentum when it comes to combating threats. In fact, the data protection market is expected to exceed more than $158 billion by 2024, reports Market Watch.

A strong security posture and implementation of a comprehensive data protection and business continuity plan is the single most effective measure that companies can employ to mitigate the significant costs of a data breach. With IBM’s 2018 Ponemon Cost of a Data Breach study reporting the global average cost of a data breach is up 6.4 percent over the previous year to $3.86 million, the time is now to create a data protection plan. The study also shows that the average cost for each lost or stolen record containing sensitive and confidential information also increased by 4.8 percent year over year to $148.

What is Data Protection?

Data protection is the process of safeguarding important information from corruption, compromise or loss. The importance of data protection increases as the amount of data created and stored continues to grow at unprecedented rates. In today’s workplace, there is little tolerance for downtime. That is why a large part of data protection planning is ensuring that a company’s data can be restored as fast as possible after any corruption or loss.

Other aspects of data protection include protecting data from being compromised and ensuring data privacy is upheld. Data Protection is used to describe both the operational backup of data as well as business continuity and disaster recovery planning.

What is its Purpose?

We believe that the purpose is clear but will give you a quick rundown anyway. Backups are no longer acceptable as a stand-alone function. Instead, they are being combined with other data protection functions to save storage space and lower costs. Without both a prevention and response plan, your business will suffer major consequences that could permanently put you out of business.

Back up and protect your data with confidence. Eliminate accidental data loss, recover quickly from malicious attacks and prevent data corruption with a proactive approach. And with different cloud options available, you can optimize your efforts for speed and efficiency.

Hopefully the information above convinced you about the importance of data protection. Now, it is time to start planning. Here where you can get started:

How to Create a Data Protection Plan

A survey of more than 200 IT professionals in the United States preformed by Quest Software reports that 73 percent of businesses rank restoring their critical applications alongside recovering lost data as their top recovery concern. Yet, as many as 78 percent of these businesses are still creating data protection plans and recovery objectives centered around data, servers or a combination of both. Only five percent of respondents said they create their recovery objectives to include applications, as well.

A data protection plan should be all encompassing. While everyone’s business is unique and no plan will look alike, there are some common themes that every data protection plan can focus on.

Identify Sensitive Data and Applications

You first have to know what data is sensitive in your organization, to know what mandatory controls need to be in place. Some common types of sensitive data include:

Personally identifiable information (an individual’s first and last name)
Health records
Card holder data
Social security number
Driver’s license number
Intellectual property and trade secrets
Operational and inventory information
Industry specific data

This is just a very basic list of sensitive information flowing through your network. Be sure to do a thorough inventory of sensitive data and applications that need protecting before you move on in your data protection planning. Once you have identified the data you need to protect, it is time to act.

Examine the Service Level Agreement

Customers have become increasingly more dependent on the services that their IT providers offer. With that, their expectations for uptime and recovery time have become just has high. When a service goes down, companies understand that they are losing money on every minute. That is why it is imperative that IT providers can meet that recovery expectation to get them back up and running.

For companies that are outsourcing their IT services to providers, be sure to understand the Service Level Agreement (SLA), so any recovery plans are resolved immediately. In addition, if services or applications go down unexpectedly, a plan for recovery that encompasses data, servers, applications are important.

Understand User Expectations

In addition to examining the SLA, understand the user expectations to ensure they both align. Understand the recovery time (RTOs) and recovery point objectives (RPOs) both the customer and the IT provider are committed to in your SLAs, and then go a step further and talk with end-users and company leaders about their true service level expectations.

Make sure your stakeholders know what to expect as you are creating your data protection plan.

Find a Reliable and Compliant Backup Solution

Your backup solution should enable fast, reliable data backup and recovery environments. Challenges to look out for with traditional data backup include:

Capacity planning
Time to restore
Security
Unpredictable costs
Bandwidth management

Look for a service that transmits your protected files offsite to secure severs to ensure your files safe from any disaster. Specifically, you should find a service provider that abides by the “3-2-1” rule of cloud backup. This ensures you keep at least three copies of your data on two different types of storage with one in a remote location. With LightEdge managed backup services, there is no need to own or manage the second storage facility yourself.

Design Effective Employee Policies and Procedures

Employees are a common cause of data breaches, data loss, and data misappropriation if policies and procedures are not enforced. When people think of employees as a threat, their minds typically go to rogue or disgruntled employees that are intentionally performing a malicious act. What businesses do not consider in their data protection plan is employees could be posing an insider threat due to their ignorance or negligence.

Not all insider employee related breaches are intentional. According to Computer Weekly, organizers of the Black Hat security conference reported that 84 percent of cyberattacks were due to human error. While the clear majority of insider threats can be attributed to negligence, there are cases of breaches due to deceptive insider actions.

At the very least, your organization should have a security policy to protect against insider threats. This is the most important tactic to prevent an attack. A security policy should include procedures to prevent and detect malicious activity.

Your company security policy should include details that limit the access to personal data about employees or customers. Specify who can access what data, under which circumstances they can access the data, and who they can share the information with.

Deploy Limited Access over Sensitive Data

Provide only ranking administrators with direct visibility into recoverability of the IT servers, data, and applications. These administrators are responsible for managing and leveraging specialized data protection tools that platform-specific backup and recovery tasks. This will enable you to bypass the time consuming, two-step recovery process that makes application recovery so challenging with most traditional backup strategies.

Conduct Regular Audits

It is important to test the effectiveness of your designed solutions. Revisit all factors that when into developing your data protection plan regularly and update any outdated information. These regular audits should evaluate your security practices and test whether your organization is following the policies and procedures outlines.

Without proper testing, you will never know if your data protection plan actually works or meets your recovery objectives until it is too late. The more you plan for a disaster or breach, and the more you test and practice how you will handle it, the more prepared you and your team will be. With adequate testing, your operations will run smoothly when you need them to.

What was a threat 10-years, 5-years, and even 1-year ago is not the same exact risks you will face today. Your plan should always be adapting to current scenarios. There are a lot of things that may break a perfect plan. The only way to find them is to test it when you can afford to fail.

Data Backup is Not Enough

Are your company’s primary servers located on the premise of your office building? What if massive flooding came through and wiped them out? There goes all the company’s backed-up files and data. Sending a copy of data offsite for disaster recovery and business continuity purposes should be considered essential.

In fact, entrusting a data center colocation facility to house your critical infrastructure would erase the need to prepare for a data outage entirely. Colocation facilities are built with security and compliance as top-of-mind items. They are designed to withstand the natural disasters and cybersecurity breaches. Many facilities even provide redundant backup options.

Data center redundancy should be designed to weather nearly any incident with minimal downtime. Data centers like LightEdge’s facilities use redundant power and cooling, geographically-diverse central offices, and multiple data network carrier access.

The reliable availability of business IT is essential to the management and livelihood of every company, big or small. All elements hinge on the dependability of your technology to deliver important information when you need it.

Finding the right technology partner to help you keep your IT operations, critical applications, and data protected is a must.

Let LightEdge Help You Get Started with Data Protection Planning

Protect your data from corruption or loss and quickly restore as needed. Our solutions enable fast, reliable data backup and recovery environments, even as a granular-level. You can choose from flexible deployment options based on your goals and budget. Our process allows companies to optimize their WAN bandwidth and encrypt backup data for additional security.

LightEdge also utilizes Vision Solutions’ MIMIX real-time replication tool designed specifically for IBM Power and IBM i OS, providing a unique backup and disaster recovery solution to the iSeries world.

LightEdge is well known for our ISO 20000 and ISO 27001-validated infrastructure and operations, and constant adherence to reference architecture. LightEdge services are audited regularly to assure compliance with HIPAA, PCI DSS, SSAE 18, and more. Our highly-trained experts are also knowledgeable about achieving compliance standards like NIST and FISMA. Partner with us to comply with archival and disaster recovery compliance standards.

Data protection best practices recommend maintaining 3 copies of data, on 2 types of storage, with at least 1 in a remote location. This strategy greatly enhances the availability of business-critical apps and data, but it requires separate storage infrastructure.

Ready to put your data protection in the hands of LightEdge’s highly-trained engineers? Contact one of our data protection experts to get started or to schedule your private tour of any of our data center facilities. We have disaster recovery, colocation, and business continuity experts standing by to answer any of your questions.

If you would like to get more information on disaster preparedness and threat prevention, download our free Guide to Disaster Preparedness or our Cyberattack Threat and Prevention guide.

Why Multi-Cloud Strategy Beats Single Cloud Almost Every Time

How Would You Migrate a Data Center to Cloud?

Measuring the Impact of Site Reliability Engineering: Strategic Value and KPIs