Cyberattacks are increasing in frequency and impact, exposing gaps in traditional recovery strategies. While many organisations believe they have effective cyber resilience plans, prolonged recovery times, data loss and dependence on workaround solutions continue to disrupt business operations.
In an interview with TahawulTech.com, Gregg Petersen, Regional Director – Middle East at Cohesity, explains why organisations must adopt a Minimum Viable Company approach to recovery. He outlines five essential steps for strengthening cyber resilience, prioritising critical systems and using automation, orchestration and simulation to restore essential operations within hours rather than weeks.
Why do organisations need to rethink traditional cyber recovery and adopt a Minimum Viable Company approach?
Cyberattacks have increased significantly, with 73% of organisations experiencing an attack, compared with 56% last year. Although 88% believe they have a cyber resilience plan, 91% admit they would still need workarounds following an attack.
Traditional recovery approaches are no longer sufficient because restoring operations can take one or two weeks, with some organisations also losing critical data. Businesses cannot afford such prolonged disruption.
A Minimum Viable Company approach enables an organisation to identify the essential applications, databases, systems and services required to resume critical operations. The objective is to restore these capabilities within hours rather than weeks, allowing the business to operate while the remaining environment is recovered.
What are the five key steps organisations should take to build an effective cyber resilience strategy
The first step is to secure the fundamentals by backing up data and ensuring those backups are immutable, locked and fault-tolerant.
The second step is to follow the 3-2-1-1 backup rule, maintaining multiple copies of data across different locations and storage formats, including an off-site or vaulted copy. Recent geopolitical developments have also encouraged some organisations to keep a protected copy outside the country or region.
The third step involves strengthening threat detection, data classification and threat-scanning capabilities. Organisations need visibility into their data and environments so they can identify potential compromises and determine which recovery points are safe to use.
The fourth step is to define the organisation’s minimum viable operating model. This requires identifying the applications, databases and services that must be restored first to resume essential business functions.
The fifth step focuses on orchestration and simulation. Recovery processes should be automated, tested and rehearsed regularly so teams know exactly what to do when an attack occurs. Cyber resilience is a journey, and organisations should assess their current maturity before progressing towards a more proactive recovery model.
How can organisations identify which systems, data and capabilities need to be restored first after a cyberattack?
Prioritisation must take place before an attack. Organisations should classify their data, applications and databases according to their importance to essential operations. They must also understand the dependencies between systems and establish a clear recovery sequence.
Building a digital jump bag is an important part of this process. It should contain the software licence keys, user credentials, identity services and other critical components required to rebuild the environment. Active Directory and other foundational services should also be recoverable through automated processes rather than manual intervention.
A clearly defined plan allows leadership teams to understand which applications and databases will be restored first, what the minimum viable organisation will look like and how quickly essential services can resume. Orchestration remains critical because recovery must be proactive, predictable and regularly tested.
Image Credit: Cohesity
Source: Tahawul Tech