What Crowdstrike can teach us

Did you have the blue screen of sadness like many people? It's wild how many people were affected by a couple of lines of code. It took productivity down unless you're not using Crowdstrike or you're also like Southwest Airlines in this fake tweet.

While I was busy trying to reboot my system to get my work laptop back online, I was thinking about how I could also work without a computer. Forget not having Internet, there was no computer! It reminded me of time when a software system we had used at a prior job was down. We raised holy heck about it. One of our users was supposed to be in a meeting with executives to present a dashboard but the meeting got moved. That could have been disastrous. And because of my hyperlinking brain, I then thought about my time as a bank examiner conducting IT exams and focusing on BCP (business continuity plan) and DRP (disaster recovery plan).

BCP for reports? Em, are you crazy?

The thing about BCPs is that you put this work into this thing and hope you never have to use it.

Which reports are critical to the ongoing operations of the organization? If there is none, you may not need a BCP and recovery timelines.

For the reports or analytics that are critical, what are the recovery timelines you can afford? Can a report be down for 24 hours? 48? This helps set expectations with users on when they can expect reports to be up and running again.

Is there an alternative way to get the information to the users? Airlines were manually checking people into flights. We used to be manual people. Does it suck? Yes. Would you rather be fast and efficient? Also yes. But for those critical items, having an alternative way to get information to the users can help them make whatever time-sensitive or important decisions they need to make.

So what Crowdstrike reminded me was that reports/dashboards/applications should be considered whether they are included in business continuity and disaster recovery plans.

FWIW, I don't think we need to drop everything and do a big contuity plan but I do think there is value in considering the criticality and continuity of reports and have a formal or informal plan.

If you're like,"This is interesting. What does a BCP include?"

Here are five major points of a BCP.

1. Risk and impact analysis
2. How will you recover your report (including timeframes)
3. Who's doing what
4. Communication-Who needs to know
5. Test out the plan to make sure it works