Cyber recovery requires a different approach to disaster recovery

Issue 2 2025 Information Security

The distinction between disaster recovery (DR) and cyber recovery is more crucial than ever. While both strategies aim to safeguard organisations from disruptions, they address fundamentally different threats and require tailored approaches. What I found particularly interesting were recent insights from a survey conducted by Commvault in partnership with ESG1 that shed light on the complexities surrounding cyber recovery, revealing a pressing need for organisations to rethink their strategies.


Modeen Malick.

Understanding the differences

At its core, DR is all about getting operations back on track after unexpected disruptions like natural disasters, hardware failures, or power outages. Think of it as the safety net that catches your business when something outside your control goes wrong. It is about restoring systems, data, and processes so that you can resume business as usual as quickly as possible. Cyber recovery, however, is a whole different ballgame. It is not about accidental disruptions, but intentional, malicious attacks.

Cyber recovery focuses on dealing with the aftermath of cyberattacks like ransomware, data breaches, or other forms of hacking. These are not random events; they are calculated moves by bad actors aiming to disrupt your business, steal sensitive data, or hold your systems hostage. This fundamental difference in intent, accidental versus deliberate, means that organisations cannot simply lump cyber recovery into their existing DR plans.

The methodologies for each need to be distinct and purpose-built. While DR is often about speed and getting back online quickly, cyber recovery requires a more cautious approach. It involves forensic analysis to understand the scope of the attack, ensuring systems are clean before restoring them and implementing measures to prevent reinfection.

The survey unearthed several alarming trends among IT and security leaders:

1. Low confidence levels: Only 26% of respondents feel confident in their ability to protect mission-critical applications and data, with just 20% feeling adequately protected when it comes to operational data.

2. Complexity of cyber recovery: A staggering 70% reported that cyber recovery is either more complex or time-consuming than traditional disaster recovery, primarily due to the additional steps required to manage cyber incidents effectively.

3. Challenges in cyber recovery: An overwhelming 91% highlighted the necessity for extensive forensic analysis to fully understand incidents before recovery can begin. Additionally, 85% acknowledged the risks involved in recovering systems without first ensuring a secure environment.

4. Need for specialised skills: Nearly 59% of respondents noted difficulties in hiring qualified personnel for cyber recovery compared to DR, indicating a significant skills gap in this area.

5. Targeted attacks on backups: The survey found that 92% of organisations have experienced attacks aimed at their backup systems, with 71% reporting these attacks as a significant portion of their overall incidents. However, 96% have implemented additional protective measures for their backup data.

6. Integration with DR: Despite the differences between the two approaches, over 52% of organisations are integrating cyber recovery planning into their broader DR strategies, reflecting a trend toward alignment in processes and protocols.

These findings underscore the critical need for organisations to enhance their cyber recovery strategies, while maintaining robust disaster recovery protocols. Cyber recovery should be viewed as a distinct approach from traditional DR, requiring tailored investments in technology and training.

By integrating cyber recovery into broader disaster recovery plans and proactively addressing these challenges, organisations can enhance their resilience against future threats. Ultimately, being prepared is essential in today’s digital landscape, allowing businesses not only to recover, but also emerge stronger from incidents.

[1] https://tinyurl.com/f5u8x3h3




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
The rise of AI-powered cybercrime and defence
Information Security News & Events AI & Data Analytics
Check Point Software Technologies launched its inaugural AI Security Report, offering an in-depth exploration of how cybercriminals are weaponising artificial intelligence (AI), alongside strategic insights defenders need to stay ahead.

Read more...
The deepfake crisis is here and now
Information Security Training & Education
Deepfakes are a growing cybersecurity threat that blur the line between reality and fiction. These AI-generated synthetic media have evolved from technological curiosities to sophisticated weapons of digital deception, costing companies upwards of $600 000 each.

Read more...
What does Agentic AI mean for cybersecurity?
Information Security AI & Data Analytics
AI agents will change how we work by scheduling meetings on our behalf and even managing supply chain items. However, without adequate protection, they become soft targets for criminals.

Read more...
Phishing attacks through SVG image files
Kaspersky News & Events Information Security
Kaspersky has detected a new trend: attackers are distributing phishing emails to individual and corporate users with attachments in SVG (Scalable Vector Graphics) files, a format commonly used for storing images.

Read more...
Crypto in SA: between progress and precaution
Information Security
“As cryptocurrency gains momentum and legitimacy, it’s becoming increasingly important for people to pay attention to financial security”, says Richard Frost, head of technology and innovation at Armata Cyber Security.

Read more...
MDR users claim 97,5% less
Sophos Information Security
The average cyber insurance claim following a significant cyberattack is just $75 000 for MDR users, compared with $3 million for endpoint-only users, according to a new independent study.

Read more...
The impact of GenAI on cybersecurity
Sophos News & Events Information Security
Sophos survey finds that 89% of IT leaders worry GenAI flaws could negatively impact their organisation’s cybersecurity strategies, with 87% of respondents stating they were concerned about a resulting lack of cybersecurity accountability.

Read more...
Efficient, future-proof estate security and management
Technews Publishing ElementC Solutions Duxbury Networking Fang Fences & Guards Secutel Technologies OneSpace Technologies DeepAlert SMART Security Solutions Editor's Choice Information Security Security Services & Risk Management Residential Estate (Industry) AI & Data Analytics IoT & Automation
In February this year, SMART Security Solutions travelled to Cape Town to experience the unbelievable experience of a city where potholes are fixed, and traffic lights work; and to host the Cape Town SMART Estate Security Conference 2025.

Read more...
Kaspersky KATA 7.0 for targeted attack protection
Information Security Products & Solutions
] Kaspersky has announced a major update to its Kaspersky Anti Targeted Attack (KATA) including enhanced network detection and response (NDR) capabilities with deeper network visibility, internal threats detection and other critical security features.

Read more...