W. Curtis Preston: How's your Dr.

Plan looking this week, we get into the nitty gritty of crafting a Dr.

plan.

We'll let you in on key lessons from frontline, recoveries

gone wrong and done right.

To make sure that you design for resilience.

You may have heard us say before that ransomware has made Dr.

No longer an option.

At one point, you might've been able to get away with thinking that a

disaster might not happen to you.

But a cyber attack.

It's not a matter of if, but when, so let's help you get ready.

We want you to be able to design a Dr.

Plan that can withstand a cyber attack or any other type of disaster.

That's because on this podcast, we like to turn backup system admins

and to cyber recovery heroes.

This is the backup wrap-up.

Welcome to the show.

I'm your host, w Curtis Preston, and I have with me a guy who I think is gonna

be super excited about the new Tesla.

What, what, what do they call it?

The holiday update Prasanna,

I think it's called, yeah, the holiday update.

W. Curtis Preston: because you're all about the autopilot.

Yeah.

So I couldn't care less when the updates rollout because as you

well know, I don't really use the features on my car, unlike you,

W. Curtis Preston: You're a bit of a Luddite when it comes to, uh, uh, this

incredibly advanced piece of technology that you have available to you.

Yeah, I just don't, I, I've built software before.

I don't trust engineers all that much, so you have to, pardon me if I don't

trust, say the car driving itself.

W. Curtis Preston: So, so boring me.

I got the new update and, uh, within minutes I was literally out

there testing the new features.

Of course you were.

W. Curtis Preston: uh.

Yeah.

Uh, both the good and the kind of annoying new updates.

We don't want to get into that.

Um, we wanna just jump right into, I wanna jump right into

saying that something else stinks.

Uh, and that is apparently based on the, the reviews that we're

getting this new, we, we talked previously about the new Windows 11.

Backup tool.

Apparently, I, I looked at three or four different articles and

they all kind of trashed it.

Um, the, the, the biggest thing I, I'd say the two biggest things that were,

you know, that they dinged it for.

One is it only knows how to backup to OneDrive.

Uh, that's number one.

And number two.

There's just this assumption that you're living 100% in the Microsoft

App store world and that if you're, so, you can select, for example, you

can select specific apps to back up, but you can only select apps that are

in the app store and not all apps.

In the App store.

Uh, and that'll probably actually go down soon.

There's, there's all these app store, uh, lawsuits that are happening right now.

Google lost a big one.

Apple won a big one.

So, you know, at some point, I, I think that the app stores

that we know it today are not.

You know, sort of that, that stranglehold that they have that's gonna go away.

So it seems weird that Microsoft is building a tool that

Prasanna Malaiyandi: But, but I don't know.

So my mom recently got a new Android phone and I was in charge because

I'm tech support for her of migrating from her old phone to a new phone.

I have to say, even on Android, they don't do a great job of my, so I.

They will reinstall the apps from your app store, which makes sense.

But even recovering your data, unless you've done certain things beforehand,

it's not actually able to recover the application to the state it was in before.

An example is WhatsApp, unless you explicitly tell WhatsApp to back up and

it uploads to your Google Drive and then it's able to restore on the new phone or

recover, I should say, on the new phone.

You don't actually get your WhatsApp messages to come across.

W. Curtis Preston: Yeah.

That's weird.

Um,

Prasanna Malaiyandi: Same thing with Apple,

W. Curtis Preston: saying that.

Are you saying that, that everybody stinks with, with, uh, but that's a, that's a,

that is the fault of the app developer.

Right?

Uh, that's, that's sort of, they both have that weird world where the apps

live in their own world and the apps, you can't back up the apps in the same way.

Yeah, but I think that's the same thing that

you run into with this Windows PC or Windows backup, right?

It's apps sort of live in their own world, and therefore you can't expect the

state of it to come completely back up when you try to restore to another pc.

Same argument.

W. Curtis Preston: sure.

Yeah.

Same argument.

Yeah.

Yeah, sure.

I, I, I guess, I think the criticism was not that it didn't handle the

app store apps well, it's that there are apps that are not in the app

store, especially on a more mature.

Box like Windows or Mac versus like the, the iPhone,

that's true.

W. Curtis Preston: uh, that, that, you know, that they don't, it's like, oh,

what, what app we don't know about?

You know, we don't know anything about that app.

But, uh, but then the other criticism that it only backs up to OneDrive and

then the backups intermingle somehow with the, with the stuff that's in OneDrive.

There, there, yeah.

There just nobody seemed to like it,

yeah, so I will say also for WhatsApp, on an iPhone,

you can only back up to iCloud.

That's the only source IT support.

It's not anything else.

So not saying that Microsoft did the right thing with just going to OneDrive and it

could have, like you said, had a better experience, but it's not unheard of,

W. Curtis Preston: Yeah.

Yeah.

Well, it just goes back to our, you know, our friend Daniel's thing,

you know, about, about, um, the, basically the consumer, the, the

ability to back up consumer stuff.

Just, it stinks in general.

Yeah, absolutely.

Um, you want to talk about this, um, this US and Australia, uh, warning

Yeah.

So yeah, this just came out.

What last?

Oh no, today actually today is December 19th, so it just came out and it

is talking about a ransomware group called the Play Ransomware Group and

talking about how they're still active.

They've had sort of 300 attacks since June of 2022, and they sort of are.

Talking about what you should be doing and how they currently exploit the

environments and what you can do to protect yourself from being exploited.

Um, Curtis, I know you were looking through it and you're like, a lot of what

they were, how they got into systems, a lot of it is kind of old issues.

W. Curtis Preston: Uh, that, that part when I was looking at the actual

report, they're like, this is this group, and they're really bad and

they're, you know, and they're, you know, and I, and I get that, I'm

glad that they're warning people.

Apparently they use double extortion, which, you know, as, as you know,

is really difficult to deal with.

Uh, but when they literally talked about how they gained initial,

the initial, uh, access, it's all via stolen credentials and, um.

Exploits that have been available for at least a year, or they've

been fixed at least a year.

One of them was the not Petia attack was five years ago.

Um, and the, and then also using things that we talk about, like RDP, uh, you

know, you know that RDP, that's, that is on by default and that it's available.

Available.

Yeah.

W. Curtis Preston: Uh, so.

I just, if, if, if people would just, if people would just listen to this

podcast Prasanna, just do what we say, like, we're not even, like, I don't

consider myself a security expert, but I will say this article, which we'll link

to in the, um, you know, it says a lot of the same stuff that we say, right.

You know, they talk about obviously having a data recovery plan, right.

Obviously the, you know, obviously we're fans of that.

Uh, then, you know, have good passwords have MFA, uh.

Keep the, the operating systems up to date.

Right.

Um, and here's another one that we talk a lot about, about segmenting networks.

Uh, you wanna talk about that a little bit?

Basically everything doesn't need access to everything else.

So segment your network.

So in case something gets hit, it doesn't take out your entire network

and can traverse laterally through your environment and attack all your systems.

So you really wanna firewall off certain segments so they're not all able to

see each other unless they have to.

W. Curtis Preston: Yeah, and you can, and again, I'm not a network, uh, person, but

I believe that you can put like laptops, you can put laptops on a vlan and you can

configure that VLAN in such a way that the laptops can't, cannot see each other.

Um, if, if that's possible because they don't need to, right.

Laptops do not need to see each other.

Uh, at least 99.9% of 'em don't.

Right.

And if they do need to see each other, the question is why.

And then figure out if there's a different way to do that.

Right.

And, and in fact,

W. Curtis Preston: go ahead.

and for a lot of that actually you

don't even need to use a vlan.

A lot of access points, especially corporate based access points, they allow

you to sort of isolate guests on the wifi networks so you can have that same

functionality without necessarily having to do VLANs or segmentation to protect

within each of the devices in the network.

W. Curtis Preston: Yeah.

And, and then they've got more advanced stuff.

They talk about monitoring for abnormal activity, filtering the network traffic

and, and validate security controls.

Um, you know, those are a little bit higher level, but honestly I think

they would stop 90 to 95% of most.

If they just did the things that we've already talked

Yep.

W. Curtis Preston: Um, and, uh, yeah.

Anyway, that is the news of the week

As you know, on each episode, we like to di dive deep into one topic.

This topic that I want to start with this week is way too big for one episode.

And

too.

W. Curtis Preston: gonna take, we're gonna take a few episodes.

Yeah.

Yeah.

It is it, and it's super, super important.

And in fact, I, I can't think of like, of all the topics that we talk about,

I know sometimes I, I say this, but like, considering what's happening

these days, would you not agree that this is like really, really important?

Yes.

Yeah.

Oh yeah.

If you're not thinking about this, you have issues.

W. Curtis Preston: You, you have issues?

Or you have

W. Curtis Preston: So what we're talking What's that?

You have problems?

Yeah.

So what we're talking about this week is disaster recovery.

Things have really changed, you know, since back in the date, right?

So a hundred years ago.

When I started this, my DR plan at, at this $35 billion corporation, our DR plan

was a box of tapes and some, and some procedures on how to read those tapes

Prasanna Malaiyandi: Which may or may not have

W. Curtis Preston: there, which may or may not have worked Right.

Um, that, that just doesn't fly anymore.

Right.

And there were a lot of companies who.

Their DR plan wasn't even as good as that.

Basically, they, they, well, first off, there were a lot of people that

just didn't send their tapes off site.

I, I don't, I pity the fool that didn't do that, but, but there were

plenty of people who their entire DR.

Plan was, I put my tapes in a box and I sent to Iron Mountain.

That's it.

Right?

And that's never been a good DR.

Plan.

What do you think?

It's, it's better than nothing,

W. Curtis Preston: Yes.

Good, good, better, best.

Right?

We talk about that a lot, right?

It's good, better, best.

Right?

but it

W. Curtis Preston: start somewhere.

You gotta crawl before you can walk, right?

but I would also say in some cases, maybe that is

acceptable, where you're okay with it taking two, three weeks potentially

to bring yourself back up from a disaster that's going to the good right.

W. Curtis Preston: Yeah, that, that, yeah.

So if, if you have an RTO that's measured in weeks and a really patient

customer base and management chain

Yeah.

W. Curtis Preston: that perhaps, perhaps that's sufficient.

It probably isn't.

But the, um, and also it was a very, and it was a very different.

Risk profile back then if you didn't live in tornado alley.

If you didn't live in Florida and or California and Earthquake

Central, you, you, this is also, remember, you, you have to go back.

This was a time before we had, uh, terrorist attacks in the us.

Yeah.

W. Curtis Preston: It was, it was a very, very different time.

So we, we've moved past that.

We moved to a point where you started to say, well, maybe if I don't live

in tornado alley, and again, this is a very US-centric part of the world,

but it's what I know geographically.

I'm sure there are.

I.

Plenty of examples elsewhere in other countries, you might have

started to develop the idea of like, well, I don't live in a place

like New York or near the Pentagon.

I'm probably not going to be the subject of a, um, like a, a terrorist attack.

So you, you still might have had a, a similar, uh, felt that you

were under a similar, similar risk.

Profile as we were 30 years ago, but then one little thing happened.

What?

What do you suppose that is?

Yeah.

So I know it's one of our favorite topics on this podcast.

Right.

And that's ransomware.

W. Curtis Preston: Yeah.

So suddenly the thing that probably wouldn't happen to you

very much could happen to you.

And we look at the, all the statistics, they're horrible, right?

Every, every survey of of hundreds of companies come back.

Uh, you know, uh, I remember when I worked for dva, right, that, that we did

a survey and I, I think it came back, it was like, I thought it was 50 50 of

people that had been attacked and of the people that had been attacked, it was

something like 60% had paid the ransom.

But I've seen surveys, other surveys and more recent surveys where the numbers

are more like 60 70% of people have been successfully attacked by ransomware.

I think

W. Curtis Preston: And unfortunately the percentages that of, um,

yeah, the Veeam study, right?

The Veeam study is a great one.

And, and that, and, and again, I wanna reiterate that was

a, like a double blind study.

It wasn't of Veeam customers, it was of, you know, many, many

companies that, um, didn't know that Veeam was sponsoring the survey.

And it came out really scary of the number of people that were

attacked and the number of people that still paid the ransom and the

number of people that lost data.

that was a scary one, is the people who

couldn't recover their environments.

W. Curtis Preston: Yeah, and so, so I would say that a DR has moved from

a should have to a, have to have.

What is there, is there, is there better words for

Yeah.

No, I, I agree.

I, I think also, like we talked about before, it's, you need to have,

everyone should be thinking about what data and services do they need

disaster recovery for at what level?

Because also, I think environments have gotten very complicated

versus what they had back then.

And I know we'll talk about this in a little bit about data centers and

other types of environments, but.

Back then, you just have to worry about a data center.

Now, I have data spread throughout the world in different services, some

owned by me, some not owned by me.

Some with different levels, like maybe the stuff that I work for.

Internal projects is our priority in terms of getting it back up and running,

and so I can wait longer versus like sales and financial records, right?

I need to keep the business going and keep my customers happy, so that

becomes more critical for me as well.

W. Curtis Preston: Yeah, agreed.

Uh, it, it's just, um, I think everybody needs something.

I.

The, the question is in terms of what your, so that's the, that's

the, that's sort of the bad news.

I don't know if that's, that's the bad, the, the bad news.

The good news is, and, and we'll talk about this in later episodes, not in

this episodes, but the good news is DR is way easier than it was back in the day.

Right.

A, a million times easier.

And the more virtualized you are, the more that is true.

And the, uh, there's a different.

Thing as to how much you're using SaaS in Pass.

But, uh, we'll talk about that.

But I, I think Dr is way easier than, than it used to be.

Um, yeah.

So one of the things I like to, uh, like to bring up, and of course, what

we're doing here is we're, we're, as we've been doing for, uh, our backup to

basic series, we've been working our way through my book, modern Data Protection,

holding up a copy for the camera.

Uh, for the, you know, couple of dozen of you that watch on, on YouTube.

Most everybody listens to this on the, on the audio format.

But, uh, for those of you that wanna see us on the Shining, see our shining

faces, you can go to the YouTube channel, uh, sa by the same name.

Um, we're working through the DR chapter and there there's this, I

have this, uh, sidebar called Excuses for Days, and these are things that

I heard from people back in the day when I was being a, a consultant

and I would work with these people.

Um, if our building blows up, I'll probably be dead and won't care.

Right.

Um, if our town is destroyed by a disaster, I'll be a lot more concerned

about saving my family and my house and won't care about any DR plan.

Um, and the, this, this is, if, if the company is destroyed

by a terrorist attack, I won't have a job, so I won't care.

wow.

W. Curtis Preston: Uh, these are reasons that actual people that.

You know, I was working with when I would say, what's the DR plan?

They're like, we don't know.

We don't care.

Yeah, it's interesting and I'm sure those

excuses wouldn't fly today.

W. Curtis Preston: Yeah.

Um, unfortunately these were excuses from my senior management.

Oh boy.

W. Curtis Preston: Uh, yeah.

Um, but yeah, so ransomware has really changed everything because

it significantly changes the chances that you would re need to

recover your entire company, right?

It, it used to be that while you might not be subject to a terrorist attack, or

you might not be subject to a flood or an earthquake, you might be subject to

a fire that takes out a server, right?

And so you are worried primarily about protecting a server.

Now you really have to be concerned with making sure you protect.

Or have the ability to recover your entire environment, whatever that is.

Uh, any comments on that?

Yeah, and I think going back to talking about

the entire environment piece.

People develop business assets everywhere, right?

It's in SaaS applications, be it Google Drive or Microsoft 365.

Um, it is on their laptop or desktop because these systems are now so powerful

versus before you had to have dedicated servers for running these instances.

Uh, you might have.

Data sitting in an AWS EC2 instance with EBS storage and stored in object

store in AWS S3 that you're using for your application, because that's just

how you've built it, because there's new technologies available, or you

might be using serverless technologies.

And so there are all these different pieces.

Going back to what you said about your environment, it's no longer

just restricted to your data center.

It's everywhere.

And so you need to start thinking about all of that data and how do you

bring back everything you need to get your business back up and running.

W. Curtis Preston: Yeah, and I'm, I'm glad you brought that up because it, we need

to talk about sort of each of those, sort of three areas where you might have, um.

Computing infrastructure that needs to be restored after an attack.

And we're going to include, you know, every time we talk about this, we'll,

we'll include all of the different things that might take your environment out.

Right?

So let's start with the, the good old fashioned data center there.

There are still plenty of companies who run their environment on data

center, and every time something goes on with the cloud, some sort of cloud.

Outage I watch online on Reddit or on the comments on the register.

It's always, I told you I not on the cloud.

The cloud sucks.

The leaky cloud, there's a guy that's a security guy that's, he

refers to it as the leaky cloud.

And uh, and I'm not gonna make that point, but my point is there are plenty

of people who still have sizable data centers that need to be restored.

What do you think, what's your feel for today's data center and the

percentage, uh, to which it is, or the degree to which it is virtualized?

What do you think?

So I would probably say 99% of a physical data

center is probably virtualized.

W. Curtis Preston: Yeah.

I, I think so too, and, and, and,

Maybe not 99, but maybe 90.

W. Curtis Preston: Right.

Yeah.

Yeah.

Because how you address the disaster recovery of a virtualized data center

is very different than the way you were, uh, you do of a physical data center.

Because the, the challenge really is, um, the, the, the challenge is not just

where do you get the infrastructure.

The challenge is how you get an image of the operating system, not just the

data, because you need to restore the server, and it's a lot more challenging.

It's, it's not, it's not impossible, but it's a lot more challenging

to do what we call a bare metal recovery of a physical server.

It is doable, right?

Um, I know there's plenty of server or plenty of products.

Um, you know, I've been spending some time with a company that

works with Veeam and does Dr.

Lately, and they.

Um, they can use any, you know, Veeam does backup of a physical

server and they're able to use that and do restorative physical server.

It's just more challenging, right?

Um, and if you are a virtualized environment, you need to address

the restore of all those images at a virtualized level, right?

You need to cater it to the, the hypervisor that you happen to be using.

Do you wanna talk a little bit about some of the hypervisors that are out there?

Yeah.

So there are a lot.

Um, the most popular one I would say, or prevalent one is.

Do we call it Broadcom now, or is it called VMware?

W. Curtis Preston: It's still called VMware

Right,

W. Curtis Preston: of a couple days ago.

Broadcom the owner, but it's still called

So VMware, right, which is very popular, but

there are other ones coming up.

So you also have Microsoft with Hyper V, which is available for any

system that runs Windows, right?

It's provided free of charge, uh, almost free of charge, I believe, right?

And it's available for everyone.

So that's another popular one.

You also have other ones that come up like Zen.

You also have Nutanix with a HV, and so there are a lot of.

Virtualization platforms out there that people use.

We could also start to talk about, uh, Kubernetes.

Right?

Which to some extent is also virtualization, right?

Containers and

W. Curtis Preston: it's sort of virtualization on steroids, right?

Yeah.

So Kubernetes containers, Docker, right.

All of those I would also classify as sort of virtualized environments.

W. Curtis Preston: Yeah.

And I would make the same statement that I said there, you need

to have a Kubernetes centric.

Disaster recovery plan for that part of your environment.

You can't just, well, obviously in that case, you can't just

pretend like it's regular servers.

You, you have to, uh, with, with, with regular hypervisors, you can kind of

pretend like they're physical servers and you can do things, but generally

speaking, you're gonna want to do something that works with that hypervisor.

And we're gonna, again, cover this more with the data centers in

the, you know, in later episodes.

But, you know, you gotta find a place.

You, you, if you've lost your data center, depending on what your

disaster is, the first thing you gotta do is replace the, the hardware.

Right?

Right.

Yeah.

Uh, that's gonna, that could be one of your biggest challenges.

But, uh, I think the answer to that for most people is probably the cloud.

Well, and I don't, I just read an article the other day,

basically, with all of AI being very popular now, even coming across servers,

I think Dell was saying that it's a 39, wait, a 39 week wait time in order

to get a server with the built-in AI capabilities with the AI hardware.

W. Curtis Preston: 30.

That's like almost a year,

Yeah.

W. Curtis Preston: Wow.

So if you are, yeah.

So if you are looking for hardware, make sure you're planning

upfront for these DR scenarios.

Rather than realizing, Hey, I hit an issue, I need to fail over.

Let me go procure hardware because procuring hardware is

going to be a good chunk of time.

You wanna make sure you have that ahead of time before the DR scenario hits.

W. Curtis Preston: Yeah.

Can I, can I poke fun at you a little

Yeah.

W. Curtis Preston: Is there any way to not plan upfront?

Can you plan in the back?

You can't

Yeah, you can plan.

You can plan on the side, you can plan on the side.

W. Curtis Preston: plan on the side.

I just, I just thought it was funny that you say you should plan up front.

I'm like, well, when else do you plan

You can plan last

W. Curtis Preston: I love you, man.

Uh, anyway.

Yeah.

Let's talk about, uh, let's talk about the, I.

I, I always wanted take, you know, ias, IAAS infrastructure as a service.

This is basically, you know, things like EC2, uh, you know, high,

I'm sorry, um, uh, Azure, VMs, gcp, VMs, that, you know, and I.

This sort of stuff.

And then also PAs, which is very close to that, right?

Um, you know, not everybody gets the difference between the two.

Basically a platform as a service is where they, they basically

give you the entire platform.

And basically like an application, you're, you're going to use RDS

is a platform as a service, right?

So then you're, you, you've got access to a.

Um, to a database that you can use.

You don't have to maintain the infrastructure, even the server, like

in the case of EC2, you have to maintain the server, the vm, the, the oss and the

application in the, in the case of a pass, you don't have to maintain any of that.

You just use the application.

But in most, in both cases, a dr.

It's very different.

Talking about the DR of.

EC2 or, uh, a RDS type database.

Let, let's just talk about this for a minute.

Um,

is it, but is

W. Curtis Preston: well, so here's, here's the thing.

So this is a, um, with a caveat, right?

Again, we're talking about risk profiles, right?

Chances are.

You're either going to be dealing with the restore of your entire,

um, cloud environment in another area of that same cloud, right?

Yep.

W. Curtis Preston: Or you are going to be restoring your entire cloud

environments, maybe to the same area, maybe to a different cloud provider.

The Restore is kind of the same.

It's just you're gonna direct it to a different target.

You're not, most likely you could, this is part of your DR plan, but you most

likely are not going to be req like.

The entire, again, with caveats, the entire AWS infrastructure is probably

not gonna go down the entire Azure infrastructure, probably not gonna go

down, at least not for a period of time.

That will make you, that will for it to make sense to activate your DR plan.

Azure, I, I can remember when Azure went down a few years ago, I dunno if you

remember this, when they forgot to renew their, their, uh, their certificate.

Yeah.

W. Curtis Preston: Oopsies.

Right.

They fixed it.

Right.

It was back up and I mean, it was, it was a major disruption, but it's

not something that takes your DR.

Environment.

Right.

Um, e even if an entire region goes down of your cloud provider, it, it, it

probably won't take down a second region.

Depends.

Depends.

W. Curtis Preston: to, okay.

Prasanna Malaiyandi: There have been cases.

W. Curtis Preston: statistically speaking.

Yes.

Depending on how they're

W. Curtis Preston: There have been cases.

Yeah.

Depending on how they do their services and if there's any dependencies

on that region that is down.

So there have been cases where authentication or other things stop

working because the main region where that was running went down

and things weren't able to fail over properly or couldn't be operational.

W. Curtis Preston: So I would say that

That's an

W. Curtis Preston: have these conversations, right?

And you need to.

I think you should solve for the thing that's most likely to happen first

before you solve for the maybe, you know, should have coulda, woulda thing

that probably won't happen to you,

So I think at some point we are gonna

be talking about testing Dr.

And other things later in this episode or in these series on dr.

But one thing I did wanna point out, since we were talking about AWS and

region failing and all the rest at their latest reinvent, they actually

announced a tool that you can simulate regional failures and other types of

infrastructure failures in AWS to be able to check and see what happens

to my environment when that happens.

W. Curtis Preston: God, that's really scary.

Um, so literally take your environment down.

I don't think it actually physically takes your

environment down, but it allows you to simulate what would happen.

W. Curtis Preston: Okay.

All right.

I gotta check that out.

That sounds really interesting.

It is

W. Curtis Preston: Um,

yeah, it can simulate major outages.

Uh, what is it?

It's called the fault injection service.

W. Curtis Preston: it's like the chaos monkey.

Yes.

It's like Chaos Monkey.

W. Curtis Preston: All right.

Yeah, so I, I guess what I'm saying here is generally speaking, the most

likely thing you're going to need to restore is your entire environment

within the same exact infrastructure, probably in a different place, right?

Because the most likely thing that will happen in a cloud world

is you receive some sort of, uh, digital, you know, cyber attack.

And you've got to restore that data in another region.

Does that seem fair?

I think that's fair.

Yeah.

W. Curtis Preston: Yeah, I mean, they've got a lot of things built in

to protect you against other things.

We know that sometimes those things don't work, right?

We OVH fire, OVH, fire.

Um, so I'm just saying most likely thing that would happen given

everything that we're talking about.

And I do think that if you are planning, as I've already said, you

should plan for the most likely thing.

First, solve that first before you move on to the less

Now, just because running it in a different area is.

Probably slightly easier.

Make sure you're doing all the things you need to do to make sure that's actually

feasible, because you might need to worry about IP connectivity and other things.

So yeah, my services may be up, but no one can actually

get to anything in the DR site.

W. Curtis Preston: Exactly, exactly.

Um, we, we've talked about that in previous DR episodes.

So the next is SaaS.

And this is a, a little bit different in that I do think it's highly possible that

a region could go down of an application and that application could become.

Unavailable to you for some period of time because it's happened and

you, it's not sup SaaS is different

You're up, you're up the creek at that point, right?

W. Curtis Preston: Yeah, you're, you are up the creek.

Because it's not like, it's like if, let's say you have Office 365, right?

Or Microsoft 365.

It's not like you could take your backup of Microsoft 365,

which I know you're doing.

If you, because you listen to this podcast, you know you should back up SaaS.

It's not like you could take that backup and then very easily, uh,

migrate to whatever is Gmail.

Yeah, you can't.

Take a backup of Microsoft 365 and migrate to Gmail.

I don't even know if that's possible or if anyone has done that.

By the way, if anyone's done that, I'd love to hear from you.

But, um, the, your most likely, again, your most likely scenario

that you're going to be using your backups for is you are restoring

after some sort of cyber attack

Yeah, because.

W. Curtis Preston: you do go ahead.

Because for that SaaS service like Microsoft

365, they are responsible for the availability of the service.

So if something happens to Microsoft 365 in the US West region, right?

Microsoft has SLAs and infrastructure to make sure that the Microsoft 365

service is available in, say, the US East Coast region or whatever else it takes.

W. Curtis Preston: Right, right.

And so they, they will be doing everything they can to get the

service back up and running.

You may, depending on what took the service down in, in the

beginning, you may have to restore your data after that service.

Imagine.

Imagine the news story that would be.

If, if a region of Microsoft 365 went down and then they go, okay,

we've got the service back up.

Now all you guys restore your backups.

Now,

Yeah.

W. Curtis Preston: can you imagine the, the news that that would be,

I mean, I mean, something very similar happened to Rackspace, right?

It was, it was, it wasn't Microsoft 365.

It was hosted exchange, but.

They basically, they, they said, look, you know, we had a large ransomware attack.

Our entire environment is fubar.

Uh, if you don't know what that means, Google it.

The, um, and then they basically migrated users over to Microsoft 365,

but they migrated them with blank accounts and then they brought the

old email back in, in a way that you could download it and import it.

But, you know, it was, it, it was months before people got their data back.

Yeah.

And so I wonder, Curtis, as we're talking about disaster recovery, maybe

it's important, at least on the SaaS side to differentiate the types of, uh,

scenarios that you're recovering from, because I think a ransomware scenario is

very different because a SaaS provider is probably gonna be like, that's not my

problem, versus an infrastructure failure that the SaaS provider is recovering from.

Which is probably they are going to help you with that.

Like they will deal with everything.

W. Curtis Preston: Wait, say that last part again.

So,

W. Curtis Preston: is gonna help?

so if, say Microsoft 365, if their infrastructure

goes down because of an infrastructure

W. Curtis Preston: right.

Yes, yes, yes.

They're gonna help.

Yeah.

yeah.

They are gonna help you out.

They're gonna recover their infrastructure with hopefully all of your data

because they're giving you the service.

Right, and it's an infrastructure failure.

W. Curtis Preston: I.

I don't, I don't know if that's the case.

I really don't.

You think you're still on your own.

W. Curtis Preston: to indicate.

There's nothing in your contract to indicate that they're doing

anything to bring your data back

So

W. Curtis Preston: the event of a catastrophic failure of Microsoft 365.

We do know, for example, that they do have delayed replicated

copies of exchange, but.

We, we don't, we don't know.

There's nothing in the contract to specify that in a catastrophic failure

of Microsoft 365, that they will restore their entire environment,

which brings your data with it.

There's nothing to indicate that in your contract.

So yeah.

So there's no guarantee they will try their best effort, but

W. Curtis Preston: right.

is not good enough for your company to survive, you should

probably have other alternatives.

W. Curtis Preston: Yeah.

Best effort that's not documented with the possibility of nothing.

Uh, yeah, definitely.

Um, which is why I think everybody should be backing up 365, but, but each of

these different things, you have to look at your part of your, your environment.

You have to look at the things that are most likely to take out

that entire environment, which.

Has to always start with, at this point, some sort of cyber attack.

And then the second one is some sort of, um,

Infrastructure

W. Curtis Preston: type of physical disaster.

Um, yeah, server failure as well, right?

So, so literally equipment failure can take out an, an environment, but

then you talk about fires, floods, earthquakes, terrorist actions.

These all take out sort of the physical infrastructure and the data along with it.

So you just need to look at those things and look to see which you

think is most likely to happen.

Um, and then start there, uh, and then work your way back.

I would just add to that, Curtis, that your business

probably encompasses data across all three of these areas, and so it's not

necessarily gonna be a one size fits all solution that you're gonna leverage.

So make sure you're thinking through it, understand where your

data is, and then go from there.

W. Curtis Preston: Yeah, exactly.

Yeah.

That, that's, that's the key to anything I think that we talk

about is the first thing I.

That we talk about is inventory, right?

Knowing where everything is, right?

I, I just published the, the, uh, copy data management, um, episode.

And the step number one is knowing where everything is.

And, uh, step number two, I think, is determining your risk profile,

determining the things that are likely to happen to your, uh, infrastructure.

Then determining the possibility, of each of those things, right?

And I mean, and your risk profile is going to be different if you live in a

metropolitan area versus, or if you live in a place like New Orleans that is under

sea level and, um, the, your, your, your risk profile is going to be different.

You have to take it all those things into account.

And I think you also have to take into account compliance

because there may be things that.

If you are, if you are the type of organization that is regulated by

another, by a set of regulations, there may be things that you are forced by

regulation to be able to restore in a, you know, under any circumstance.

And so you.

You might not have the option like earlier, right?

I was saying, you know, do the thing, the most important things first.

You also have to make sure that you're doing the things that

are covered under regulation.

What, there is one thing that I think we did not touch

upon, which actually may not be in your book, um, but what do you think about

data that lives on people, on users, end devices that is not synced to the cloud?

Right.

We haven't,

W. Curtis Preston: Yeah, I don't,

on that, but hopefully you are doing a backup of

some sort and maybe in a later chapter we can talk more in detail about this.

But I think that's also another thing to consider.

W. Curtis Preston: yeah.

I don't think of that.

Perhaps I should think of that when I think about a disaster recovery.

The um.

Obviously, I think that any data, wherever it resides needs to be backed up.

And I do strongly believe in backing up in devices.

I'm backing up this in device, right?

And the, uh, to the cloud for the record.

Um, because I, 'cause that's, I, I just think that's the best option

for an absent-minded person like me.

The, um, I just, I don't think of that.

Because I think where it'll come

W. Curtis Preston: there's nothing I have against of it.

I just don't think of it.

Right.

But there could be a mass, uh, cyber attack that takes out all

of your infrastructure and you do need to be able to restore that.

And especially when it comes to the restore aspects, right,

or the recovery aspects, it's how do I now bring all my users back online so they

can continue functioning and the business can continue functioning after an attack.

For instance, if I was during the pandemic, right, you had a bunch of

people working remotely and they had data, and sure we could say the data

was synced to the cloud, and so it's not as important about the data,

it's how do I recover that hardware?

After a ransomware attack across my environment.

Right.

I think those are the sort of things which will become interesting.

W. Curtis Preston: Yeah, I think, I think all of us found out just how

much fun it was to do mass orders of hardware during the pandemic.

It was a very good couple of quarters for Dell and, and

Apple I'm sure with everybody ordering as much as they ordered.

No, it's, I think that's a real, that's a really good point.

Thanks for that extra, um, flavor.

Um, alright, well that's, I think, I think that's enough as an overview of Dr.

We got.

We have plenty more to talk about, but, uh, again, you gotta first

figure out everything that you have.

You got to then figure out what your risk profile is and figure

out what you're gonna tackle first.

Uh, from a DR standpoint, and I, I do believe in the concept of

low hanging fruit and grabbing and taking care of that first, where

you can get success and or where.

Basically tackling the most likely thing to happen first.

Right.

All right.

Well thank you again for a great conversation.

Uh, always a pleasure, Curtis.

I like our chats.

W. Curtis Preston: Me too.

And, uh, thank you again to our listeners for listening.

We'd be nothing without you.

That's a wrap.