Elevator Business Cyber Security: Information Systems Disaster Recovery

Businesses large and small create and manage large volumes of electronic information or data. Much of that data is important. Some data is vital to the survival and continued operation of the business. The impact of data loss or corruption from hardware failure, human error, hacking or malware could be significant. A plan for data backup and restoration of electronic information is essential. An information systems disaster recovery plan should be developed with the business continuity plan. Technology recovery strategies should be developed to restore hardware, applications and data in time to meet the needs of the business recovery.

What is Data?  

Data is an IT resource for every business. Businesses generate large amounts of data and data files are changing throughout the workday. Data can be lost, corrupted, compromised or stolen through hardware failure, human error, hacking and malware. Loss or corruption of data could result in significant business disruption. For instance, losing maintenance records due to a cyberattack could lead to missed service appointments, causing elevators to malfunction and resulting in customer dissatisfaction. Loss or corruption of data could result in significant business disruption, such as not being able to track elevator usage patterns or schedule timely repairs.

Cyberattacks in the Elevator Industry 

The elevator industry relies heavily on technology and interconnected systems. While this boosts efficiency and safety, it also opens the door to cyberattacks. Cybercriminals can target elevator control systems, maintenance records, and communication networks, causing serious problems. 

Types of Cyberattacks 

• Ransomware: Hackers can lock down elevator control systems and demand payment to restore them. This can halt operations in busy buildings, leading to major disruptions. 

• Data Breaches: Sensitive information, like maintenance schedules and customer data, can be stolen. This compromises security and can lead to further issues. 

• DDoS Attacks: Distributed Denial of Service (DDoS) attacks can overwhelm elevator systems, making them unusable. This is particularly harmful in high-traffic areas. 

• Malware: Malicious software can infect elevator systems, causing malfunctions or unauthorized access. This can result in downtime and safety risks. 

Information Systems Recovery 

Data backup is essential for an information system disaster recovery plan. For an elevator business, this includes data on maintenance schedules, service requests, and performance metrics. Developing a data backup strategy involves several steps:

1. Identify what data to back up, such as maintenance logs and service records.
2. Select and implement hardware and software for backups.
3. Schedule and conduct regular backups.
4. Periodically check that data has been accurately backed up.

Information systems recovery priorities should align with the recovery priorities of business functions and processes. Identify the IT resources needed to support time-sensitive business functions. The data recovery time should match the recovery time objective of the dependent business function or process.

Recovery strategies should anticipate the loss of one or more system components:

• Computer Room Environment: Ensure a secure computer room with climate control and a backup power supply for elevator system servers.
• Hardware: Plan for networks, servers, computers, wireless devices, and peripherals essential for elevator diagnostics and communication.
• Connectivity: Include options for fiber, cable, or wireless connections to keep remote monitoring and control systems operational.
• Software Applications: Prepare for systems like electronic data interchange for parts ordering, email for service coordination, enterprise resource management for inventory, and office productivity software for administrative tasks.
• Data and Restoration: Have strategies for data recovery and restoration to ensure that elevator performance data and maintenance records are quickly restored to maintain service continuity.

Developing an Information Systems Disaster Recovery Plan 

Businesses should develop an information systems disaster recovery plan. Start by compiling an inventory of hardware (e.g. servers, desktops, laptops and wireless devices), software applications and data. The plan should include a strategy to ensure that all critical information is backed up. 

1. Identify Essentials: Determine which software applications and data are critical, and list the hardware needed to run them. 

2. Use Standard Hardware: This makes it easier to replicate and reimage new hardware. 

3. Have Software Copies Ready: Keep copies of all program software for quick reinstallation on replacement equipment. 

4. Set Priorities: Prioritize which hardware and software need to be restored first. 

Document the information systems disaster recovery plan as part of the business continuity plan. Test the plan regularly to ensure it works.

Data backup and recovery are essential for the information systems disaster recovery plan. Developing a data backup strategy starts with identifying what data to back up, selecting and implementing hardware and software for backups, scheduling regular backups, and periodically checking that the data is accurately backed up.

Keep Your Information Systems Secured 

Disaster recovery depends on having data and computer processing replicated at an off-site location unaffected by the disaster. When servers fail due to natural disasters, equipment issues, or cyber-attacks, the company needs to retrieve lost data from a backup location. Ideally, an elevator business can also transfer its computer processing to that remote site to keep operations running.

Whether creating a new disaster recovery strategy or improving an existing one, assembling the right team of experts is a crucial first step. Collaborate with IT specialists to form a team responsible for handling disasters. Business owners should also consider using cloud services and software-as-a-service (SaaS) solutions for more efficient and flexible remote work options. This approach reduces reliance on a single data center or main headquarters. Ensure your plans include IT redundancy—having multiple systems at multiple sites. This way, if one system is compromised, the business can still operate.