IoT Devices and Cyber Disaster Recovery: What You Need to Know

The practical corporate executive plans for the worst while hoping for the best. When disaster takes systems offline, organizations need to have a streamlined recovery process in place. When a catastrophic event occurs, a company’s disaster recovery plan provides IT teams with a roadmap to restore services and operations as quickly as possible. As organizations incorporate more Internet of Things (IoT) devices into their business, they are required for any disaster recovery strategy that restores full operations. 

However, IoT devices create unique disaster recovery challenges. Typically, restoring these devices resets factory settings, which means that getting operations back to their original state requires reconfiguring and recalibrating them in a specific order. The time it takes to get these devices back to optimal conditions increases recovery costs and strangles the organization’s ability to get back online quickly. In fact, according to Gartner, 70% of organizations are poorly positioned in terms of disaster recovery, with 54% likely suffering from “mirages of overconfidence.”

By incorporating IoT devices into disaster recovery plans, organizations can create a holistic, more effective strategy that reduces business interruption costs and improves overarching operational efficiency. Further, it increases their odds of staying in business after a disaster. Not all businesses do recover.

What is a Disaster Recovery Plan?

A disaster recovery plan consists of the documented policies and processes that an organization uses to quickly resume operations after an unplanned natural or human-induced event disrupts them. 

Examples of disasters include:

• Natural Events: earthquakes, floods, hurricanes, wildfires
• Cyberattacks: ransomware, malware, DDoS 
• Technology Failure: hardware, equipment, power outages
• Intentional Attacks: terrorism, sabotage

The disaster recovery plan outlines the steps required to address the emergency effectively, providing a systematic approach for how to proceed with or resume critical operations. These structured processes enable the organization to efficiently allocate resources to recover data and reestablish information system functionality after a catastrophic event. 

What Is the Difference Between Disaster Recovery and Business Continuity?

Although disaster recovery and business continuity are related, they focus on different aspects of the organization’s operations:

• Disaster Recovery: Restoring IT infrastructure and data access to get critical systems and applications online as quickly as possible
• Business Continuity: Taking proactive measures to ensure essential functional operations can continue, including broader concerns like opening physical offices or branches as quickly as possible

Why is Disaster Recovery Important?

A well-structured disaster recovery plan enables organizations to respond to events promptly, limiting their financial impact. Some specific benefits include:

• Ensuring Business Continuity: Modern functional business operations rely on applications and data, even ones located in physical offices. 
• Enhancing System Security: Data backup and other disaster recovery processes correlate to cybersecurity protections. 
• Improves Customer Retention: Reducing business and service outage times builds customer trust and loyalty. 
• Reduces Recovery Costs: Getting operational services back online faster reduces costs arising from business revenue and lack of productivity. 

Elements of a Disaster Recovery Strategy

A robust disaster recovery strategy enables organizations to proactively prepare for the worst outcomes for enhanced resiliency. 

Asset Inventory

A comprehensive asset inventory identifies all of the hardware, software applications, and data crucial to business functions. With a list of critical data and applications, IT teams can:

• Backup data for faster restoration
• Replicate and re-image new hardware quickly
• Re-install software on replacement equipment

Risk Analysis

The organization’s risk analysis should consider various risks, including geographic location and system vulnerabilities. For example, an organization with headquarters in a landlocked area is less likely to experience a flood. Meanwhile, an organization that engages in regular vulnerability scans and updates operating systems and software reduces data breach risks. 

Business Impact Analysis

A business impact analysis (BIA) reviews disaster scenarios to anticipate potential business operations impact. The process helps:

• Identify critical functions
• Determine acceptable downtimes
• Understand the consequences of various types of disasters

Prioritizing Applications

Classifying IT assets as mission-critical, important, or non-essential enables the organization to prioritize recovery activities. With policies and processes that restore critical assets first, organizations can return to near-normal business operations faster. When determining benchmarks for restoring critical systems, organizations can use the following metrics:

• Recovery Time Objective: how much time elapses before application, system, and process outage damages the business
• Recovery Point Objective (RPO): how recent data needs to be when recovered after an outage before damaging the business 

Documenting Dependencies

Documenting the relationships between different systems and processes identifies interdependent systems and reduces business disruption by accounting for these relationships. Organizations should carefully map out these dependencies so they can coordinate recovery across the IT environment.

Verification of Readiness

Testing the organization’s disaster recovery processes and practices is critical. While everyone hopes to avoid a catastrophic event, they occur, as evidenced by the COVID-19 pandemic lockdowns. 

Organizations should test their incident response and disaster recovery processes to mitigate risks and reduce errors. For example, reviewing IT and Internet of Things (IoT) assets’ configurations can help avoid errors before declaring that a recovery point has been reached. 

Holistic Disaster Recovery Includes IoT Devices

Increasingly, IoT devices are assets critical to the organization’s business operations. From the Internet of Medical Things (IoMT) devices that support patient care to the Internet of Industrial Things (IIoT) that support critical infrastructure employees, these difficult-to-manage and secure devices should be included in the organization’s disaster recovery plan. 

Inventory Devices

Organizations need insight into the devices they have and how critical they are to continued operations. IoT devices connect to networks, but traditional IT scanning solutions can take them offline. Organizations need passive scanners that detect devices and supply the following information about them:

• Hardware: manufacturer, model, serial number
• Software: operating system, version, firmware revisions
• Device type and function
• Applications
• Security assessment: vulnerabilities and risks

Analyze Risk and Simulate Risk Scenarios

IoT risk modeling enables organizations to consider hypothetical situations that ultimately result in reduced downtime and improved resilience. Organizations should look for IoT solutions that understand the risks and threats that their industry faces. When searching for an IoT risk modeling solution, organizations should look for ones that provide:

• Device risk scores: insights into the risks that the device poses and what would happen in the event of a service outage
• Remediation risk simulation: understanding the different activities that reduce risk by simulating different strategies and options
• Overall organization risk: visibility into dependencies and their impact on business operations

Identify Vulnerabilities and Prioritize Remediation Activities

Organizations need to include cyberattacks, like ransomware attacks, as part of their disaster recovery plan. To proactively mitigate risks, they need passive scanning technologies that identify vulnerabilities and risky devices. Any IoT vulnerability management solution should:

• Identify where exploitable vulnerabilities are within the environment and for each specific device 
• Prioritize activities on real-time exploitability
• Provide actionable remediation recommendations that include applying security updates or implementing appropriate compensating controls, like deactivating unnecessary services or implementing microsegmentation
• Understand dependencies such as the correct sequence of activities that can conflict, such as firmware upgrades and making configuration changes. The same actions – in the wrong order – may not result in a restored device that would match earlier snapshots of its configuration.

Understand Normal and Anomalous Behavior

Without understanding how IoT devices act normally, organizations have no baseline for how to define abnormal behavior. Detecting and analyzing anomalous IoT device behavior enables organizations to prevent service disruptions arising from cyberattacks or misconfigurations. With visibility into this, companies can take proactive steps to mitigate technology risks that disrupt business operations. 

Detect and Investigate Incidents

By incorporating IoT devices in their disaster recovery plan, organizations can complete business-critical investigations faster. From cyberattacks to devices falling offline from a misconfiguration, IoT solutions should help recovery activities by providing forensic data like:

• RAM from servers 
• Traffic information from network devices
• Data transferred to an FTP server

Asimily: Improve Disaster Recovery by Including IoT 

Asimily provides holistic context into an organization’s environment when calculating Likelihood-based risk scoring for devices. Our vulnerability scoring considers the compensating controls so you can more appropriately prioritize remediation activities.

Organizations efficiently identify high-risk vulnerabilities with our proprietary, patented algorithm that cross-references vast amounts of data from resources like EPSS (Exploit Prediction Scoring System), Software Bills of Material (SBOMs), Common Vulnerability and Exposure (CVE) lists, the MITRE ATT&CK Framework, and NIST Guidelines. It understands your unique environment, so our deep contextual recommendation engine can provide real-time, actionable remediation steps to reduce risk and save time.

Asimily customers are 10x more efficient because the engine can pinpoint and prioritize the top 2% of problem devices that are High Risk (High Likelihood of exploitation and High Impact if compromised). Asimily’s recommendations can easily be applied in several ways, including through seamless integration with NACs, firewalls, or other network enforcement solutions.

To learn more about Asimily, download our IoT Device Security in 2024: The High Cost of Doing Nothing whitepaper or contact us today.