Role-Based Access Control

Businesses with a large number of employees are at risk of loose data access rules. Unrestricted business-wide access increases the probability of accidental deletions, disruptions by rogue administrators and successful phishing attacks. Conversely, overly centralized backup and recovery processes may inhibit efficiency, resulting in retention gaps and slower recovery times. Assess current roles by listing who is responsible for each portion of the backup and recovery process. Calculate how often different parts of the business rely on data recovery. Map which administrators are responsible for each part. Verify you can meet your RTOs and RPOs. Mark where bottlenecks and redundancies exist.

Regularly monitor and test how well role-based access controls support current operations. Personnel and priorities shift quickly for businesses, which means that IT procedures well-suited to earlier circumstances may suddenly be ineffective. Fast-growing businesses, in particular, may outpace their backup and recovery capacity without noticing it until it is too late. Stay protected by updating user roles and guidelines to match changing priorities. Consult previous user role frameworks to determine how different setups affect recovery times. Regularly test your RTOs and RPOs with mock disaster recoveries to have an accurate reading of your situation.

Multi-tenancy enables businesses to create separate backup and recovery environments for each business unit. This setup gives geographically dispersed branches more independence, which can increase recovery times and reduce bottlenecks. For businesses working with sensitive information, multi-tenancy isolates critical data from normal workflow operations. To effectively employ business unit multi-tenancy, clearly delineate tasks between central and unit-level administrators. Retention policy gaps can easily emerge if user roles overlap but functional responsibilities are unclear. Audit business unit processes with test recoveries to confirm that effective data protection practices are in place.

Use the information from your assessment to create a comprehensive user role framework. The framework should be a living document reflecting the business’s current distribution of roles. This will help in the future to both investigate data loss events and reassign roles if processes become inefficient. Decide whether a centralized or decentralized backup and recovery process works best for your business. In either setup, assign users for each step of the process: configuration, managing backup and recovery jobs, scheduling, user roles, and accessing support and help center services. Keep the number of authorized users low to minimize the potential for data loss.

Establish consistency by formulating and communicating backup and recovery objectives to users. Guidelines should be designed to achieve the business’s strategic objectives but include specific instructions for each business unit. Formulate achievable RTOs and RPOs to make disaster recoveries predictable and administrators accountable. Define specific backup schedules to prevent retention policy gaps. Stipulate specific destinations and sources to ensure that backups are organized and readily accessible. Cross-reference guidelines with users’ roles so that employees have access to perform their jobs. Contain users’ permissions to their responsibilities to limit data mismanagement.

Multi-tenancy allows Managed Service Providers (MSPs) to offer customers disaster recovery as a service (DRaaS) and backup as a service (BaaS). Multi-tenancy separates tenants, that is, customers, into their own isolated environments for backup and recovery operations. As an MSP, create user roles for both your employees and your customers. Build employee roles that can provide IT support and troubleshooting to customers. Assign the self-service administrator or self-service user role from the presets to your tenants or create custom roles. Tenants remain completely isolated and cannot see the roles of other tenants. They can, in turn, assign roles and permissions to users in their environments.