How IT teams can put restoration workflow solutions in place

It’s a familiar story for any IT pro: In the wake of a ransomware attack or other system-destroying incident, you need to restore your workflows as quickly and effectively as possible.

As IT Brew reported earlier this year, ransomware attacks in particular have left enterprises scrambling. Executives have to decide whether to pay the ransom and restore operations. Setting up successful restoration workflows requires testing the system and establishing timelines for uptime.

RapidScale CISO Brent Neal told IT Brew that, rather than a quick flip of the switch, restoration is a process that demands time and preparation. The first step is an audit to gauge the reliability and preparedness of your response.

“You can’t jump and think that everything’s going to be taken care of in a security program,” Neal said. “It is a maturity journey, you have to walk through a very methodical plan, and that takes time.”

But whether the solution in place actually works is another question. Teams are often on the back foot when it comes to balancing restoration procedures with time concerns.

Figuring it out. Restoration takes effort, said Mark Christie, field CTO for StorMagic, and it’s important to pair preparation work with a regular cadence. Making sure you understand how timing and resources fit into the restoration workflow is key for IT teams.

“Some of them, at least those that are prioritizing this stuff, would do that on a monthly basis, whereby they can determine what that recovery objective looks like, how quickly they can get there, how quickly they can get things back,” Christie said. “Those things should happen and should be prioritized.”

Assessing how to move forward after a ransomware attack is important, Neal said, because often third-party providers offering restoration services are less interested in what’s realistic and more in trying a variety of solutions to see what works, regardless of the client’s specific needs.

“They promise some sort of unrealistic expectation because they’re trying to gather the customer’s business,” Neal said. “If you’ve never done a restoration and determined how long it will take you, you can’t make accurate promises.”

Money talks, you-know-what walks. Cost is a big part of restoration plans, especially for organizations with tight margins. Enterprises have to balance a number of concerns that Christie termed “the boiling mess of the moment” when you’re trying to ensure you’re back up quickly.

For IT teams, that often means balancing the “hardware infrastructure costs to be able to implement this stuff, and and the mix of licensing and subscriptions and subscription expiries and all of those different things that a sysadmin has to be able to manage and understand to be able to actually fulfill and follow through on that restoration test.”

It’s critical for companies to “make it real with reporting from the technology you’re using and being able to demonstrate where the bottleneck and slowdown is and how that might be improved upon, if possible,” Christie added. “Anything that we do in IT and infrastructure should be an ability to be able to demonstrate reality.”