LaRon Walker - Impacts of Disaster Recovery

 

Running Head: Impacts of Disaster Recovery

1

Impacts of Disaster Recovery

LaRon Walker

Master of Informaon Technology and Internet Security S ecurity

April, 2010

 

2

ABSTRACT

Any business or organizaon is vulnerable to the risk of a disaster occurring without warning whether natural, accidental, or intenonal. These risks create the necessity for companies to become more proacve in disaster recovery pracces and prepare for these types of unforeseen events. These recovery strategies are very important, as they are the backbone of the business if some type of disaster where to occur. Failure to prepare for such an event could result in the destru destrucon con of the business. This document will discuss some of the recommended steps to plan for a disaster, and three industry standards that can help guide the development of an eecve, ecient disaster recovery rec overy plan.

 

3

Impacts of Disaster Recovery

LaRon Walker

Master of Informaon Technology and Internet Security S ecurity

April, 2010

When operang any business, one must always consider the risks of natural events that could cause the loss of valuable data whether whether in paper or digital form. Some people believe having a backup strategy alone is enough in the event a system or storage device crashes. However, they fail to include

the possibility of backups being being corrupt or destroyed via a natural disaster, disaster, re, or hacker aack. With this in mind, the connuity of the business would be at risk if proper steps are not taken to ensure that all informaon has a path to be recovered in a fast fast ecient manner. This type of preparaon is commonly referred to as Business Connuity Management (BCM).

There have been many dierent industry standards that have been developed in the last few years that were created to help businesses recover in the event of an unforeseen disaster. disaster. Aer researching, I have found three ISO standards when used together, will cover all aspects of BCM, including Business Connuity Connuity Planning ( BCP) and Dis Disaster aster Recovery. These ISO standards are:



ISO/IEC 24762:2008: Informaon technology -- Security techniques --Guidelines for informaon and communicaons technology disaster recovery services



ISO/IEC 27002:2005: Informaon technology --Security techniques -- Code of pracce for informaon security management

 

4



ISO/PAS 22399:2007: Societal security - Guideline for incident preparedness and operaonal connuity management.

ISO 24762 is the standard in that focuses on Disaster recovery. The theory behind this is to help

businesses dene the most crical informaon necessary for the business to operate in the event of a disaster, and how this informaon informaon will be backed up, stored, and retrieved whether paper or digital digital.. In today’s business world, it is common common for companies have onsite as well as o osite site storage facilies. This technique covers the event if a building or its contents are unrecoverable. unrec overable.

ISO 27002 is the standard that focuses on security policies that involve access, assets, communicaon, and operaon management management and also informaon security. This standard applies to network access, data access, acc ess, and physical access (building) alike.

ISO 22399 is the standard that focuses on dening the actual BCP. BCP. Per Barr (2008), ISO22399 help businesses and organizaons:



"Understand the overall context within which the organizaon operates;



"Idenfy crical objecves;



"Understand barriers, risks, and disrupons that may impede crical objecves;



"Evaluate residual risk and risk tolerance to understand outcomes of controls and migaon strategies;



"Plan how an organizaon can connue to achieve its objecves should a disrupve incident occur;



"Develop incident and emergency response, connuity response and recovery response procedures;



"Dene roles and responsibilies, and resources to respond to an incident;

 

5



"Meet compliance with applicable legal, regulatory, and other requirements;



“Provide mutual and community assistance;



"Interface with rst responders and the media; and



"Promote a cultural change within the organizaon that recognizes that risk is inherent in every decision and acvity, and must be eecvely managed."

The above three industry standards together along with proper tesng against various disaster scenarios can help ensure a business’s future in the event of a disaster.

Business Connuity Management encompasses Disaster Recovery and a Business Connuity Plan (BCP). These all fall under Informaon Security, Security, as Informaon Security not only involves

controlling access to networks and data, but also the securing of data in the sense of being recoverable, along with proper tesng pracces to verify the integrity of the data. Per Ulasien (2009), the recommended steps when developing a BCP are:

1.

Create Create a Busin Business ess C Con onnui nuity ty Plann Planning ing T Team eam

2. Est Establ ablish ish a B Busi usines nesss Connu Connuity ity B Budg udget et 3. Ide Idenf nfy y All Crical Crical Bus Busine iness ss Func Funcon onss 4. Ide Idenf nfy y All Promin Prominent ent Busi Busines nesss Threa Threats ts 5. Dev Develo elop p and Imple Implemen mentt a Threat Threat Miga Migaon on Pl Plan an 6. Dev Develo elop p Connu Connuity ity and and Recover Recovery y Procedu Procedures res 7. Doc Docume ument nt the the Busin Business ess C Con onnui nuity ty Plan Plan 8. Tr Trai ain n Empl Employ oyee eess 9. Develo Develop p an and d Ex Execute ecute a Busines Businesss Connui Connuity ty Te Test st Plan Plan 10. Estab Establish lish a Test and Maintenance Maintenance Schedule Schedule

 

6

Failure to follow any of the above steps can result in a gap in the recovery process, which in turn could cause other parts of the connuity plan to fail, ulmately destroying the business.

Informaon Security covers many aspects of businesses operaons including Business

Connuity Management, Planning, and disaster recovery, along with network, data, and physical access control. When considering the future future of any organizaon, organizaon, one of the mos mostt important components that must be addressed is proacve preparaon in the the event of a system, data, or building disaster. This strategy should be frequently reviewed and tested to ensure that all techniques maintain the highest level of integrity, as this process could determine an organizaon’s future.

References

Barr, J. (2008). ISO Standard for Disaster Recovery . Faulkner Informaon Services. Retrieved April

24, 2010 from Faulkner Informaon Services database.

Ledford, J. (2010). Business Connuity for Corporate Libraries . Faulkner Informaon Services.

Retrieved April 24, 2010 from Faulkner Informaon Services database.

Ulasien, P. (2009). Preparing a Business Connuity for Plan. Faulkner Informaon Services. Faulkner Informaon Services database.

Retrieved April 24, 2010 from