Author: John Jackson and Dan Dec

continuityinsights.com

Let’s explore one of the recovery strategies most often employed in the recovery solution process: the work-from-home option. Through my involvement with hundreds of enterprise organizations, it is clear that the work- from-home recovery strategy has increased in popularity over the years. There are a number of reasons for that. It is relatively inexpensive for organizations already deploying laptops to employees. It provides fairly high flexibility at an individual level. And, as a recovery solution, it is easily understood by executive decision makers.

However, this option has proven to be more complicated and problematic than it initially appears. Key issues include privacy and security risks, from a technical perspective, as well as the capacity of the organization to manage the required business processes to effectively support the strategy.

Continuity Context
It is important to examine the work-from-home strategy in context. To do, let’s review several other commonly employed work-area recovery strategies. Note that a comprehensive recovery strategy will typically employ some combination of these options.

      1. Designated alternate location within an organization: A key benefit is that the organization controls this option, as no significant third-parties are involved (other than typical support and value chain needs).

      2. Offload work to other groups within the organization or to third-parties:   This option leverages resources already in place within the organization. One of the benefits is the availability of staff that is familiar with the organization and ideally has received some level of cross-training to maintain critical processes.

      3. Third-party alternate work area facilities: Either through a shared or dedicated arrangement, the organization contracts with an alternate site work area vendor for facilities and various services that can be tested and deployed should the organization need to declare a disaster. This solution requires moving people to recovery location(s).

      4. Mobile work area facilities: This solution provides alternate work area resources to any designated location and is appropriate for certain types of disasters or emergency situations or as a potentially lower cost alternative to fixed site facilities. These solutions include telecommunications, power generation, data connectivity, and computing resources.

      5. Quick Ship: This option typically is selected to support other recovery strategies as a way to reduce the costs of alternate facilities. Upon declaring, fully-imaged PCs can be delivered as needed. Organizations need to have addressed who will receive PCs and where the people will be located.

      6. ”Scramble Strategy”: Wing it at the time of disaster (ATOD) is, in fact, an option. While there are effective, low-cost solutions to reduce the impact of a loss of facilities, many organizations have selected a “scramble strategy” (either by design or lack thereof). While clearly unacceptable in many situations, this solution can be applicable to organizations with an RTO of several days or weeks. However, it is recommended that these organizations have work area requirements documented and ready, along with a working knowledge of real-estate availability in the required recovery zone.

That’s the big picture. Now back to work-from-home. Protecting the privacy and security of data can present a significant challenge. In addition to sensitive data in transit across unsecured networks and at rest on mobile computers, the potential for malware and viruses on home computers to impact the corporate network increases the challenge of making work-from-home actually work effectively.

Virtual Desktop Recovery
Virtual desktop recovery (VDR) separates the physical machine from a virtual desktop environment through a client server computing model. The virtualized desktop is then stored on a remote central server so that when users work in this environment, all applications, programs, and data are maintained and run centrally.

The use of an encrypted USB stick encompassing the virtual environment is another means to employ this virtualized strategy. This enables the users to access their virtual desktops from any capable device including PCs, laptops, thin clients, or smart phones. A key benefit is that this strategy does not require the organization to provide and distribute the hardware, which is a challenge during a disaster.

The virtual desktop has also gained visibility through a more radical methodology, often called “bring your own PC” (BYOPC). This is an approach some organizations are taking in order to provide some of their employees the flexibility they want in the PC they use at work and reduce the organization’s help desk and maintenance costs of managing the PC environment. Some of the benefits from a recovery standpoint include:

• By treating any PC or endpoint as “un-trusted”, security is contained within the virtual environment and there is little concern about what else is on the PC. In most installations a VPN connection back to the organization’s systems is required and can limit any saving of files to central server environment including shared files or to a secured USB stick.
• This approach reduces the privacy, security, and infrastructure concerns of people using non-corporate provisioned PCs. The business continuity/ disaster recovery plan would not have the added burden of provisioning, configuring and distributing PCs, but could rely on the PC equipment already in place within the employee base.
• The ability to maintain the VDR environment on a USB stick reduces the reliance of personnel taking home cumbersome laptops every day. This is always an issue during office hours as well, because during an office emergency, even if staff have a laptop, they are usually instructed to evacuate and leave everything.
• Enabling a security on-demand option whereby users can download the corporate virtual environment from the Internet also is possible if the USB stick is not available or is not the chosen method of distribution.
• The centrally managed nature of these encrypted environments also enables the organization to send a “kill” command to lost USB sticks.

Wrapping Up
One of recovery planning’s biggest challenges, getting a remote workforce in place in a secured manner, can be addressed through VDR. VDR can make work-from-home recovery a viable strategy, when due-care and preparation are employed. Part of the preparation should include VDR procedures to ensure that that the privacy and security of the organization’s information assets are maintained according to the standards, even when a business interruption event occurs and a disaster is declared. Appropriate training and awareness are not only advised, but prudent and necessary.