Disaster Recovery

1
Disaster Recovery
2
Disaster Recovery

• Recovery planning
• Data backup
• Contingency planning
• Testing contingency plan
• Business continuity

3
Recovery planning

• Need for recovery planning
• Natural disasters
• Disasters caused by employees
• Sabotage
• Hackers
• Armed conflict

4
Need for recovery planning

• Information is an asset
• Protect all sensitive information
• Increased dependency on information for delivery
  of services
• Cost savings
• Business Impact Analysis
• What are the critical services?
• How quickly they should be restored?
• What is the pain threshold?

5
Natural Disasters

• Plan for
• Earthquakes
• Tornados
• Floods
• Plan for employee access to data after a natural
  disaster

6
Employee caused disaster

• Facility entry log
• Facility surveillance
• Facility access control
• Evidence protection

7
Sabotage

• Identifying perpetrator
• Monitoring for potential sabotage

8
Hackers

• Hackers pose an external threat which cannot be
  easily controlled
• Keep the confidential information in a secure
  system

9
Armed conflict

• Plan for permanent loss of some data
• Nature of loss will be unpredictable
• Protect the systems rather than the infrastructure

10
Data Backup

• Backup data
• Local
• Remote
• Real time
• Test data recovery periodically
• Test backed up data periodically for its
  relevance
• Periodic update of the recovery plan

11
Contingency Planning

• Contingency planning consists of
• Incident response plan
• Disaster recovery plan
• Business continuity plan
• Incident response involves
• notification of key people
• Documenting the incident
• Contain the damage due to the incident

12
Business Continuity

• Service Level Agreements
• Software escrow
• ISO 17799 addresses business continuity
  management
• Cold / warm / hot site
• Restoration vs. recovery
• FARM (Functional Area Recovery Management)
  specifies plans for operational area recovery

13
Business Continuity

• Case Study of MIT Business Continuity plan
  http//web.mit.edu/security/www/MIT_Pub_Plan.pdf
• Case Study of Avaya Business Continuity plan
  http//www1.avaya.com/enterprise/whitepapers/lb225
  8.pdf

14
References

• Disaster recovery planning exchange
  http//www.drie.org/
• Disaster Recovery http//www.dri.ca/
• COBRA http//www.ca-systems.zetnet.co.uk/risk/
• COBRA http//www.riskworld.net/method.htm
• Business Continuity http//web.mit.edu/security/ww
  w/MIT_Pub_Plan.pdf

15
References

• Natural Disasters preparedness http//www.colorado
  .edu/hazards/informer/informerupdate.pdf
• Business Continuity Plan glossary
  http//www.drj.com/new2dr/model/bcmodel.htm
• Avaya white paper on Business Continuity
  http//www1.avaya.com/enterprise/whitepapers/lb225
  8.pdf