Information security and risk management
Akash
Chapter14Powerpoint.pptxManaging Risk in Information Systems
Lesson 14
Mitigating Risk with a Disaster Recovery Plan
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
1
Disaster Recovery Plan Overview
Restore critical business process or systems after a disaster
Sometimes called
Contingency planning
Business resumption planning
Corporate contingency planning
Business interruption planning
Disaster preparedness
Page ‹#›
Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Critical Success Factors
Elements that are critical to the success of a DRP include:
Management support
Knowledge and authority for DRP developers
Identification of primary concerns, such as recovery time objectives and alternate location needs
A disaster recovery budget
Page ‹#›
Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
3
Management Support
Resources
Leadership
Employee support
DRP development authority
Page ‹#›
Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Resources – People and money must be provided for a DRP development and enhancement, which is also an ongoing process.
Leadership – With top management support the risk manager along with the IT department and the business continuity plan (BCP) Manager provide knowledge and leadership through teamwork.
Employee support – The entire organization must understand that the organizations very existence depends on a sound and effective DRP plan.
DRP plan developer authority – The ability to gather data and work with subject matter experts (SME’s) without interference from outside forces.
4
Importance of Backups
Backups of data
Off-site copies
Electronic vaulting
Remote journaling
Page ‹#›
Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
5
Cold, Hot, and Warm Sites
Page ‹#›
Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Cold Site
A cold site is an available building.
It has electricity, running water, and restrooms, but none of the equipment or data needed for critical operations.
It may have raised floors if needed to support a server environment, however, it does not include any equipment, data, or applications.
Hot Site
A hot site includes all the equipment and data necessary to take over business functions.
A hot site will be able to assume operations within hours and sometimes within minutes. It usually has personnel at the location 24 hours a day, 7 days a week.
Warm Site
A warm site is a compromise between a cold site and a hot site.
It includes most or all of the equipment needed, but data is not usually kept up to date. The equipment is maintained in an operational state.
If a disaster occurs, the systems are updated with current data and brought online.
6
Cold Site
Available building
Hot Site
Equipment and data necessary for business functions
Able to assume operations within hours or minutes
Warm Site
Compromise between cold and hot sites
Operational equipment
Capable of updating and going live
Electricity, running water, and restrooms
No equipment or data
May support a server environment
Personnel on location 24/7
Usually no data
Cloud Computing Alternatives
Not location dependent
Page ‹#›
Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
7
Virtualization Alternatives
Servers hosted as files
Files can be copied to another host
Page ‹#›
Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
8
Common Elements of a DRP
Purpose and scope
Disaster/emergency declaration
Communications
Emergency response
Activities
Recovery procedures
Critical operations, customer service, and operations recovery
Restoration and normalization
Page ‹#›
Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Critical Business Operations
Ensure all elements are identified
Page ‹#›
Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
10
DRP Best Practices
Ensure BIAs are complete
Establish clear purpose and scope
Review and update DRP regularly
Conduct test exercises on the DRP
Page ‹#›
Managing Risk in Information Systems
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
When implementing DRPs, you can use several different best practices. The following list shows many of these:
Ensure BIAs have been completed—BIAs identify critical business functions (CBFs).
The critical business functions are used to identify the critical business operations and critical servers and services.
Start with a clear purpose and scope—The purpose and scope statements help ensure the DRP stays focused.
Resources are wasted when steps and procedures are taken that are outside the scope of the DRP.
Review and update the DRP regularly—You should review the DRP at least annually.
If you change critical systems covered by the DRP, you should review the DRP to determine if the changes affect it.
Test the DRP—Testing ensures that you can implement the DRP as expected.
When testing the DRP, it should not affect normal operations.
11
