How Higher Ed Can Rethink Their Approach to Disaster Recovery
Simply asking whether an institution has a backup solution is old-school thinking that needs to be retired. Chris Bevil, principal for global cyber resilience and artificial intelligence at Commvault, suggests reframing the question as, “Can I recover the parts of my organization that matter most, quickly and safely?” Recoverability, he says, is what determines whether an organization can survive a cyber incident.
Higher education institutions can start by identifying their most critical systems, such as payroll, billing, student data or email, Bevil notes, and define how long they can afford to be down and how much data they can afford to lose. “At the end of the day, having a copy of your data doesn’t help if you can’t cleanly restore it when it counts,” he adds.
Is Disaster Recovery as a Service a Good Fit?
Vanover says there are solutions that incorporate automation and managed recovery at a lower cost. A skills gap can be an issue among the smaller IT teams colleges may have, so relying on an on-demand service for disaster recovery may make more sense.
Bevil adds that institutions should evaluate a solution as “part of a broader operational continuity strategy, not just another cloud service.” He suggests these practical questions:
- What systems need to recover first?
- How fast do they need to come back?
- Who actually declares a disaster?
- Who is responsible for failover and failback?
- How often is recovery tested and proven?
- What costs show up during a real recovery event?
DISCOVER: Managed cyber resilience and disaster recovery services keep operations moving.
“DRaaS tends to make the most sense when an organization needs predictable, repeatable recovery but lacks the internal resources to build and maintain that capability itself. The simplest way to look at it: If you can’t confidently ensure recovery in-house, DRaaS should absolutely be on the table,” Bevil says.
The Role of Immutable Backups for Higher Ed
In this era, immutable backups are a must-have, Vanover says. If an institution doesn’t have one or more copies of its backup data that are immutable, that should be considered an emergency for its environment. In ransomware cases, where malicious actors can target backup data, having immutable storage is one of the most effective ways to support recovery.
Vanover says that the most ideal, “ultraresilient” storage has one or more of these characteristics: It’s offline, air-gapped, immutable or it requires at least two-person authorization. He also highlights the 3-2-1 backup rule: three (or more) copies of data on two different media, one of which is offsite.
Bevil agrees that immutable backups are becoming a baseline requirement for institutions, but they’re not something that can just be turned on and forgotten. Institutions should follow these guidelines:
- Set the right retention windows
- Lock down access controls
- Enforce multifactor authentication
- Regularly test restores
“Immutability isn’t a silver bullet. It won’t stop ransomware from getting in. But it significantly improves your ability to recover without paying an attacker. That’s the difference that matters,” Bevil says.
UP NEXT: Cybersecurity solutions lead to institutional resilience.
Prioritizing Backup and Recovery Amid Tight Budgets
People are as integral to disaster recovery as technology and processes. So, Vanover says, higher education institutions should consider cross-training their staff so that expertise and responsibility don’t fall to just one person on the team. If that expert is on vacation when downtime happens, there should be someone else who is trained and can step in. That could be a partner on retainer, he adds.
Bevil notes that organizations should not protect their entire environment at the same level, because that can lead to overspending in some areas while underprotecting the most critical systems.
The institutions best suited to recover aren’t always the ones with the biggest budgets, he adds: “They’re the ones that understand what matters most and have proved that they can get it back.”
