Question

Win 2k8 server which has IIS 7, SQL Server 2008 installed, 5Tb disk space and is part of the domain, is running an asp.net web application under windows authentication.

The website is used per day at working hours by 15 users concurrently.

All of the data is stored in SQL Server database and file systems.

The system is important to business but is not the primary source of making money – its more of management tool. Therefore the data inside the db and files is very important.

What should be my disaster recovery strategy?

Answer 1

Desaster Recovery Strategies depend on several factors:

• desaster scenarios you need to mitigate
• desaster probability
• desaster consequences for business

Each of the above needs to be assessed before you can define a robust desaster recovery strategy – some relevant questions (there are much more):

• Is the data reproducible (i.e. by some calculation/transformation of data from other sources etc. ) ?
• What is the maximum acceptable downtime ?
• Is some external catastrophe part of desaster scenario (like a Tornado and/or electricity failure…) ?
• Is willfull damage to the system something you need to account for (like a Hacker attack or similar) ?
• What is the cost to rebuild the system ?
• What is the probability and cost of failure for each relevant (according to your business needs) desaster scenario ?
• Is it necessary to be able to go back in time (i.e. to account for logical errors that changed data in unwanted ways) ?
• Are there any “internal attack vector” to secure the system against ?

Depending on the answers to the questions above etc. you can choose different strategies to mitigate your risks – for example:

• Is a multi-site / redundancy (online and/or offline) strategy relevant (different physical location for example or encrypted cloud storage etc.) ?
• Is a backup mechanism in place ? Is it sufficient ?
• How do the DB and the filesystem relate (i.e. when you backup both independently there could be a consistency problem!) ?
• Does the restore mechanisms offered by your backup solution meet expectations (i.e. consistency, speed, how long does a restore take etc.) ?

Whatever strategy you employ you need to keep the following in mind:

• Document it thoroughly
• Get management approval (that all relevant scenarios are represented and that all needed measures for dealing with them are up to their expectations!)
• Test it regularly (i.e. simulate the scenarios and follow the documented procedures to check whether it works and/or needs modification)
• Include the cost etc. for the strategy in the budget of the system/application as mandatory (no changes without decision from the process/busisness owners)