As your business grows, it becomes increasingly important to have a robust disaster recovery plan in place. This plan should be regularly tested to ensure that it is effective. But it’s turning out that only 54 percent of organizations have a disaster recovery plan in place. Even more worrying, a good number of those with a DR plan don’t conduct disaster recovery testing. This should never be the case and there is an urgent need for organizations to change this trend especially now when cyber attack vectors are on the rise. It is always a good idea to have a solid disaster recovery plan in place, but testing your plan is just as important.
Let's look at the best practices that should underpin your DR testing, starting with a brief definition of what disaster recovery testing really means.
What is disaster recovery testing?
Disaster Recovery Testing (DRT) is the process of evaluating the efficacy of a business' disaster recovery plan. In other words, it's a way to make sure that your company can actually rely on your disaster recovery plan to function in the event of a major catastrophe.
The reason many companies don't perform DRT perhaps has got something to do with perception. For a long time, many IT managers viewed DRT as a non-issue that can wait or be forgotten altogether. They don't place it at the same level as other types of tests, for example software testing. Unfortunately, this assumption that DRT is inconsequential is already costing businesses. If you can spend resources to implement a disaster recovery plan, then a test to ascertain the robustness of this plan cannot be so much to ask. You have already done the bigger part, testing should be easy.
Testing should be a core part of your disaster recovery plan, however sound it might be. In fact, ignoring testing is one of the quickest ways to invite disaster to your business. There is a reason students are constantly doing tests. There is a reason cars undergo rigorous test drives before being released to the market. There is a reason software testing is a fundamental part of the software development process. Imagine if a disaster were to hit your business and your IT department suddenly reports that the disaster recovery system is not working. This would spell the end of your company, especially if you rely heavily on a functional IT network — and many businesses do today.
Disaster recovery testing can greatly increase a company’s chances of being able to quickly and effectively recover from a disaster.
Recommended reading: What is the difference between IT Resilience and Disaster Recovery?
How does disaster recovery testing work?
Disaster recovery testing usually involves simulating a disaster scenario and then assessing how well the organization's disaster recovery plan works. This can be done on a small scale, such as testing how well a backup server works, or on a large scale, such as testing how well an organization's entire disaster recovery infrastructure works.
The main aim of disaster recovery testing is to determine whether a disaster recovery (DR) plan can work as expected, without fail. It identifies whether a DR plan can meet a company’s predetermined Recovery Time Objective (RTO) and Recovery Point Objective (RPO) requirements. Furthermore, it provides feedback to organizations to improve their DR plans to better respond to any issues caused by an unexpected event.
Common disaster recovery testing approaches
There are a couple of methods that companies use to execute a successful disaster recovery testing. Some of these methods ensure that business practices align with the DR plan, others cover ongoing system changes, while some cover software and hardware testing by simulating disasters and restoring data centers, files, and systems to full functionality.
Let’s look at the main test approaches.
1. Technical tests
There are two types of technical tests; parallel and full interruption or live testing.
Parallel tests
In parallel testing, a properly functioning system is restored to a separate network that could be in a totally different location. The goal is to put the backup and restore systems to test with the main goal of exposing any inherent weaknesses. The business remains operational since the real system is not interfered with. You don't have to set up a separate server elsewhere if this is not possible. You can actually use a virtual machine and do the test in the cloud, making the parallel test even much more affordable.
However, parallel tests are not full tests. They test the backup and restore functionalities and help sort permissions and other issues. But the restored system isn’t actually used, and users don’t access it. As a result, issues such as ensuring that the DNS (domain name service) entries are redirected to the right place aren’t tested. It isn’t clear whether the new system can run applications without production loads.
Full interruption or live testing
Full interruption tests involve downing the main system and trying to recover it. It's much a more thorough and intense test that can cause severe and expensive downtimes if the recovery plan fails. It is also not possible in some cases due to regulatory concerns and public safety.
The best way to carry out this test is by migrating the main system to an alternative location, probably from the main server to a virtual machine on another server. This could still cause disruptions, but it’s faster to migrate back to the original server than to bring back the original server from scratch in case the DR plan fails.
The best alternative would involve restoring a backup to a virtual machine or alternate server without downing the main server, then changing DNS entries or network addresses to direct traffic to the virtual machine or alternate server. This leaves the main server intact but without traffic.
2. Walkthrough
This test involves a step-by-step review of the DR plan with the client. It provides all stakeholders with the steps and ensures the plan does not overlook anything added since the last test.
Walkthrough tests normally involve running a series of tests on a small subset of data to ensure that the methods used to recover the data are working as expected. This testing is often used in conjunction with other types of testing to provide a comprehensive view of how the data recovery process is working. Walkthrough disaster recovery tests can be used to test both manual and automated recovery processes.
3. Tabletop
This test is a «what if» scenario that lays out a specific disaster and asks each team member how they would respond if that disaster struck. A representative from every department within the organization should attend, and knowledge of the key business processes that depend on IT is vital. This test may reveal gaps in the DR plan that the IT team should address. Fires, break-ins? All of these things can happen without warning, and if you're not prepared, you could be facing a lot of damage — both financially and in terms of your reputation.
Best practices for disaster recovery testing
A company may adopt different disaster recovery testing best practices depending on the budget. For example, migrating services from one server to another is cheap and easy. But migrating servers can be costly while migrating entire data centers can be incredibly expensive. It's about the budget the client allocates to disaster recovery testing.
Disaster recovery experts have to balance cost and availability. Some departments or lines of business, like archived accounting records, don't need to be available immediately in case of a system failure. However, the production database, e-commerce system, and website should be available as fast as possible.
Generally, this is a checklist of best practices that we recommend for a successful disaster recovery testing (DRT).
1. Define the scope of each test
Randomly testing everything may lead to data corruption and loss. Avoid this by defining the scope of each test. Seeking answers to these critical questions will simplify the scoping.
- Are you going to use a cloud-based environment for the disaster recovery test?
- How do your IT team members interact when there's friction between them?
- What is the level of communication between departments?
Answers to these questions will help determine the importance of each application and define priorities in disaster recovery testing.
2. Practice inclusivity
Disaster recovery testing is not only meant for the top management. You should also share the findings with the rest of the DR team. Multiple copies of the test report should be available to the DR team, so they know the gaps in the disaster recovery plan and what they need to do.
Ideally, you want to test with as many people as possible, but that's not always feasible. You need to strike a balance between getting the most accurate results and keeping things manageable.
Your team should include representatives from all the different areas that would be affected by a disaster. This includes everyone from your tech department to your marketing team to your customer service reps. You also need to include people who are not directly involved in day-to-day operations, such as your executive team and your board of directors.
But make sure you don't overwhelm yourself with too many people or too many tests.
3. Consider BCDR technology
It’s advisable that you consider business continuity and disaster recovery (BCDR) technology to execute actionable DR testing. Though businesses are free to rely on in-house technology, this do-it-yourself attitude can result in issues like inconsistent disaster recovery testing, costly overheads in maintaining a separate DR testing environment, and missing out on critical resources for IT projects.
Consider leveraging BCDR technology for efficient DR testing while maintaining lower ownership costs.
4. Tests should be frequent
Many organizations find out that their DR plan isn't functioning properly after an event takes down their systems and they are unable to restore them. Regular and thorough disaster recovery testing is the only way of finding and fixing such problems.
A good rule of thumb is to test at least once a year. That should be enough to make sure your disaster recovery plan is up-to-date and effective.
Related reading: Factors that influence disaster recovery solutions
5. Isolate the testing environment
Selecting a DR testing environment away from the primary production environment is essential. Vet the DR testing environment thoroughly before you begin the actual testing. This practice ensures that testing does not disrupt the tasks and services of the production environment. It is the best way to identify DR plan gaps without interrupting business continuity.
6. Document each test
Most organizations don't document their disaster recovery testing exercises and the respective outcomes. These records help you keep track of gaps in your testing, which you can address in the subsequent tests. Documentation also records your efforts in case of a disastrous event and people start pointing fingers.
7. Test both the team and the DR plan
Disaster recovery testing should include the hardware, software, and the people interacting with them. Testing employees provides an opportunity to ensure that they not only know how to respond to a disaster but also appreciate the valuable role that testing plays.
Also read: Benefits of Cyber Security Awareness Training
8. Identify disaster levels
Different disasters have varying impact scales on a business. A good DR plan needs different response levels for different disaster levels. Identifying disaster levels allows you to allocate resources in the most efficient way and ensures that you cover all testing areas.
Furthermore, the more the responses, the more complex the DR plan. The complexity of the DR plan will determine the most appropriate DR testing methodology. However, the testing methodology should cover all areas of the DR plan.
9. Test in real environments
Don't just test your disaster recovery plan in a lab environment — always test it in the real world too. Simulate different disaster scenarios, such as cyber attack, or a power outage, or some other type of emergency. And make sure that you test your plan with all of your different business units, not just your IT department. By testing your plan in as realistic an environment as possible, you can be sure that it will stand up to the real thing when it happens.
10. Regular reviews and updates
Your disaster recovery scenarios need to be updated and reviewed regularly, even if it has been working successfully. Remember the IT environment is constantly changing, and your tests can easily be outdated and become ineffective. Regular review of your company’s test strategies allows you to identify gaps and fix them in a timely manner. You don't want to keep using a test that gives the wrong status of your disaster recovery plan.
Conclusion
Those who have ever witnessed or experienced the consequences of a natural disaster will tell you that having a solid plan in place is essential. But what happens when that plan is never put to the test? Over time, small changes can creep in, slowly making your plan less effective in remedying threats. That's why it's so important to regularly test your disaster recovery plan. By simulating different types of disasters, you can identify any weak points and make sure that your plan is up to the task of keeping your business running during an emergency. In today's world, a well-tested disaster recovery plan is more important than ever. Don't let your business be caught unprepared-test your plan now and be ready for anything.
