Ah the cloud. A stellar piece of human ingenuity and design that allows us to access our data from anywhere and provides opportunities for distributed computing. From a Disaster Recovery perspective, it sounds like we have entered Valhalla. It’s distributed, scalable, always-on, sounds perfect right? Wait a minute. This sounds too good to be true.True resiliency is about defense-in-depth (Not just for IT, goes for people and hardware too). More than just having a plan, it’s all about maintaining a variety of options available to you in the event of the worst. The cloud is a good tool, but it is just one tool. A cloud can be a solution in and of itself, but other mitigation measures may be required. A good, thorough business impact analysis (BIA) will tell you exactly how far you need to go (in terms of dollars, or mission accomplishment). The bitter pill is that a necessary solution may require more than just dumping data into a cloud. The bitterness comes from the cost associated with multiple solutions, but again, data integrity and the ability to recover may be worth the cost.Before lunging into a cloud solution, ask these questions:
- Do I need off-site data storage?
- What can I trust to be stored on a system I don’t control?
- Do I have to worry about data mobility?
- What about accessibility? Do I need this data within a certain time period? Does it need to be remotely accessed from a location across the country?
- How will I recover if I have to start from a green-field?
There are many cloud providers out there and each of them is different in terms of their design, how they can help you answer the questions above, and service level offerings. Like any major system, there are always weaknesses and vulnerabilities that may be 3rd, or even 4th order. It takes a skilled risk professional to analyze, ask the questions and figure out exactly how everything works. I'll follow up with an explanation of the questions above. We'll also explore a few of the major cloud providers and the services they offer that can provide further resilience to your business, but we'll also explore some of the weaknesses behind them.In the end as with all things in Business Continuity, your BIA is your go-to source for preparing and defending your options list. Having multiple answers is never cheating during an incident. It’s just good business.