![\"CIO](\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2022\/08\/MicrosoftTeams-image.jpg\")
<\/p>\n<\/p>\n
This is part of Solutions Review\u2019s Premium Content Series, a collection of contributed columns written by industry experts in maturing software categories. In this submission, Commvault<\/a> CIO Reza Morakabati offers a short CIO resources library featuring three tools to help you achieve IT resilience.<\/em><\/strong><\/p>\n At the same time that data has grown in importance, however, the footprint of most organizations\u2019 data estate has expanded well beyond the traditional data center. This sprawl makes a company\u2019s data more vulnerable to sophisticated ransomware and other cyber-attacks that can cripple operations and rob organizations of access to their data.<\/p>\n The bottom line? Data\u2019s growing value, as well as its growing vulnerability to these threats, has made IT resiliency more important than ever. As a result, CIOs and other IT leaders need to tap into resources that span people, processes, and technology to effectively deliver the levels of IT resiliency they require.<\/p>\n A frequently overlooked resource for IT resiliency is the creation of a risk-aware culture throughout the organization, from top to bottom.<\/p>\n In practical terms, this means that security isn\u2019t just the responsibility of the CIO or the IT team \u2013 it\u2019s the responsibility of Joe in accounting, Mary in legal, and Peter in marketing, and so on. We cannot avoid risk, so instead, we need to promote knowledge and understanding of what risks we face so that we can recognize and plan around them.<\/p>\n Everyone has to be made aware that phishing attacks are a real and persistent threat \u2013 and that clicking on the wrong link or giving out the wrong information over the phone to someone pretending to be someone they\u2019re not, can have disastrous consequences.<\/p>\n Additionally, because everyone deals with sensitive corporate assets of one sort or another on a daily basis \u2013 whether that\u2019s spreadsheets with sales numbers, customer contracts, or strategic marketing plans \u2013 attention needs to be paid to how those assets are being secured. Is someone storing files in a folder that hasn\u2019t been locked down? Are they using a public file-sharing service with minimal security to send someone a large file because it\u2019s the path of least resistance?<\/p>\n One of the cheapest investments in resiliency that a CIO can make \u2013 one that, despite the low cost, delivers maximum bang for the buck \u2013 is to invest in training your people on security best practices, whether that\u2019s proper storage of files or how to recognize the telltale signs of a phishing or social engineering attack. This training is not a \u201cone time only\u201d type of affair \u2013 it should be done on a regular, ongoing basis, preferably monthly.<\/p>\n As a thought experiment, everyone in the company should imagine that a devastating security breach has occurred, and then ask themselves: What\u2019s the one task that I\u2019ve been putting off that could have helped limit the impact of that breach? Then, they should make it a priority to tackle that task the very same day. That\u2019s part and parcel of creating a risk-aware culture. Ask everyone in your organization what tasks they might have been putting off on their to-do list that might potentially have helped you to be more secure and resilient.<\/p>\n Maybe an account manager has been meaning to archive a sensitive email thread or move some contracts into a secure document repository, but she keeps getting distracted by all the various fires she needs to put out with each new day. Ask them to prioritize that task for the day or their week.<\/p>\n In creating a risk-aware culture, organizations should also consider the implementation of cyber deception technology, as part of an integrated approach to managing risk. Cyber deception has emerged as a vital piece in layered cybersecurity strategies, offering sophisticated tools that detect and divert attacks before they cause harm. Catching \u201cthe bad guys\u201d ahead of time gives the good guys more of a fighting chance.<\/p>\n Another key resource that CIOs can leverage in order to deliver IT resiliency is consolidation and automation.<\/p>\n This is first and foremost about reducing complexity in the overall tech stack. The more elements you have, the larger your attack surface and the more opportunity for vulnerabilities. Companies should aim to make that surface as small as possible by reducing complexities.<\/p>\n Turning to SaaS applications is a good way to help achieve this goal while maintaining IT resiliency. This is due to the shared responsibility model, whereby cloud providers offer logical and infrastructure-level security and platform access controls, while responsibility for user access and data control remains in the user\u2019s hands.<\/p>\n Keeping these options in mind, a good first step in consolidation and automation is to look at a particular workflow \u2013 say, the customer support environment \u2013 and start examining the processes and the technical infrastructure that supports it. Actually, put pen to paper and map out the architecture \u2013 what does it look like? You\u2019ll be able to count the number of systems, integrations, and touchpoints, as well as see what is SaaS versus what is not. Gaining this fundamental sense of the level of complexity around various workflows will help prioritize which workflows need to be consolidated first.<\/p>\n While carrying out this task, companies should pay particular attention not just to the number of applications in a particular environment, but to the number of integrations. Integrations are where a lot of IT systems fail, especially if they are custom-built \u2013 and a compromised integration can serve as an easy attack vector that allows bad actors to find their way from a single system into the many others that it is integrated with.<\/p>\n While consolidation is an important measure of IT resiliency, automation is also key. That\u2019s because manual processes create opportunities for people to make mistakes, and mistakes create openings for hackers and other bad actors.<\/p>\n For instance: An innocent slip-up \u2013 like a server admin accidentally forgetting to check the box on a security setting when deploying a new instance of a service \u2013 can create an opening that can easily be exploited. Automating that process doesn\u2019t just make the process more repeatable and scalable \u2013 it helps take human error out of the picture, eliminating the kind of accidental security loopholes that can compromise IT resiliency.<\/p>\n A final resource not to be ignored is a comprehensive and full-fledged business continuity\/disaster recovery (BC\/DR) plan<\/a><\/strong><\/span>. No matter how secure and well-prepared you are as an organization, there\u2019s no such thing as being invulnerable \u2013 and you have to prepare for the time that something bad happens to you.<\/p>\n This requires CIOs to think not just about technology, but about the business processes they support. Consider DR to be the technology piece of the equation: Some sort of disaster has struck, and you\u2019ve lost your system and lost your data. How do you recover it as quickly as possible and get back up and running? You need the right technology.<\/p>\n BC, by contrast, is the process part of the equation. If you lose access to either your tools or people performing processes, can you ensure that your processes still work? Think here of a process like payroll, sales, or customer support. If you suddenly take away people and roles in one particular geo or at one particular office because of an unforeseen event, what do you do next to ensure business continuity?<\/p>\n Before the pandemic, CIOs weren\u2019t wrestling with these types of questions very much. The traditional CIO role focused more on DR because it\u2019s more directly related to the tech stack. COVID-19 has changed the role of the CIO in that they now need to be part of the conversation around business continuity and how to keep processes moving even if a piece of technology fails.<\/p>\n It should be noted that practice makes perfect when it comes to BC\/DR. You need an accountable person or team who is really focused on this effort \u2013 read as: not doing it as a side task on top of their other responsibilities. They need to be in charge of extensive documentation and regular, ongoing testing and practicing so that when something happens, it’s almost like an automatic reaction or \u201cmuscle memory\u201d to initiate the BC\/DR plans and keep the wheels turning.<\/p>\n There\u2019s no shortage of challenges facing companies and their data, but the right resources, properly leveraged, can deliver the IT resiliency they need to protect their data and blunt the impact of a cyber-attack or other disaster.<\/p>\n By creating a risk-aware culture; consolidating their tech footprint while automating out the potential for human error; and practicing effective BC\/DR<\/a><\/strong><\/span>, companies will find that they have powerful resources at their disposal to prevent a raft of potential disasters from disrupting their company\u2019s operations.<\/p>\n![\"\"](\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2021\/12\/SR-Premium-Content.gif\")
In today\u2019s digital economy, where companies have digitized most of their core business processes, data is more valuable than ever. Not only does data fuel companies\u2019 day-to-day operations \u2013 but it is also a valuable source of information that can be analyzed to generate insights and improve future business outcomes.<\/p>\n\t\t\t![](\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2021\/05\/21_BUDR_SB_BG_Blue_800.gif\" "\\"Data")
<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\nResource #1: A Risk-Aware Culture<\/strong><\/h3>\n
Resource #2: Consolidation and Automation<\/strong><\/h3>\n
Resource #3: Full-Fledged BC\/DR<\/strong><\/h3>\n
Disrupt Potential Disruptions<\/strong><\/h3>\n
![\"Download](\"https:\/\/solutionsreview.com\/backup-disaster-recovery\/files\/2020\/02\/DP_VM_SB_800.jpg\" "\\"Data")
<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n","protected":false},"excerpt":{"rendered":"