VLCM IT Industry News

I have to confess that a few years ago I was one of the most outspoken opponents of the cloud. At that time, cloud was really nothing more than a fancy word for outsourcing and there seemed to be a very real danger that huge numbers of IT professionals would lose their jobs to rampant cloud outsourcing. As is the case with everything in IT however, the cloud has evolved. Cloud services are no longer about completely outsourcing corporate IT. There are very real, and legitimate use cases for the cloud.

The biggest selling point today is that cloud services reduce costs on things like server hardware and server maintenance. Rather than an organization having to purchase physical devices, they are able to lease space on a cloud provider’s hardware. This sharing of hardware resources saves money because no one single organization is forced to incur the costs of a full server.

As someone who speaks to audiences all over the world about disaster recovery, I get the opportunity to hear firsthand how a number of organizations handle disaster preparedness. Most IT professionals seem to accept the idea that disaster is not a matter of if, but when, and that disaster preparedness is essential. Even so, there is one big mistake that gets made over and over again.

The single biggest mistake that I see on a regular basis is organizations creating their backup and recovery efforts as a first line of defense against data loss, rather than as a last line of defense. While I do not want to downplay the importance of backups in any way, I believe that data restoration should only occur as a last resort.

There are two main reasons why I recommend avoiding data restorations unless you have no choice. First, the restoration process almost always results in at least a little bit of data loss. By its very nature, a restoration results in the loss of any data that has been created since the time of the most recent backup.

Over the years, I have done a lot of work related to backups and various other forms of disaster recovery. In doing so, I have found that there are a number of fundamental concepts that seem to hold true across organizations of nearly every size. This article discusses five such concepts.

1. You Need At Least Three Copies of Your Data

The first bit of advice that I give anyone who asks about backups is that in order to be completely protected, you need at least three copies of your data. The first copy is your live data. Live data is the data that is actively in play on your network, and is used on a day-to-day basis.

The second copy of your data should be a local backup. It is extremely important to have a backup that is easily accessible, and that resides within your own data center.

The third copy should be a remote backup. Ideally, this should be a backup either to a public cloud or to a remote data center. In a pinch the requirement for a third copy of the data can be fulfilled by creating a tape based backup and shipping those tapes to a safe location. Regardless of the method however, a remote backup is the only way to protect your data against a data center level disaster.

Many of the organizations that I have been involved with perform either an annual or a biannual security audit. The stated purpose of these audits is usually to look for security vulnerabilities. In actuality however, the audits are often times performed as a matter of tradition or of dealing with some sort of mandate. That being the case, there is sometimes a failure on the part of the organization to follow through on making use of the audit results.

A security audit can be a very effective tool for determining an organization’s security strengths and weaknesses. However, if an organization is going to undergo the effort and expense of a comprehensive security audit than they need to have a plan in place for dealing with the audit’s findings.

In my opinion, the best time to do a security audit is at the end of the year or near the end of the organization’s fiscal year. That way, any deficiencies that are detected as a result of the security audit can be addressed at the same time that the budget is being created for the following year.

One of the biggest mistakes that I commonly see made with regard to IT security is assuming that security is a "set it and forget it" proposition. Threats change over time, and the security configuration that you use today might not necessarily be a good idea tomorrow.

In order to remain secure, organizations need to assess their current security situation on a regular basis. Vulnerability scans must be performed at least quarterly, with a more comprehensive security audit taking place at least annually. These tests can help you to find weaknesses in your defenses. 

As someone who writes hundreds of articles and blog posts and a number of books and white papers each year, I tend to get a lot of mail from readers. I try to answer as many of these letters I possibly can, but there are only so many hours in a day. Most of the time when I answer a question, my answer is a very short response and a link to a webpage that I hope will help the person with their problem.

A few months ago, I had something of a rude awakening. I received an email from a guy who was asking for help with a technical problem that he was having. I sent him a link to an article that I had written. This article contains step-by-step instructions for solving the issue at hand. Rather than a thank you however, I received a scathing reply.