EH-Net

This month RichM tackles disaster recovery and business continuity. One would think that since he was hired to secure the joint, that he would have support from management on such plans. Not so fast. Seems like everyone has mountains to climb.

Permanent Link: [Article]-BCP and DRP from Scratch (http://www.ethicalhacker.net/content/view/124/24/)


Be sure to add your comments,
Don

BCP/DRP are among the unglamorous and often forgotten aspects of security. Security practice aims to keep the business rolling, so that includes backup (and more importantly restore), disaster planning, incident response policy and all of the other work that ensures if something goes titsup the damage is minimised. Good to see an article focused on this aspect since it can potentially save a company from ruin.

Jimbob

This is where your Project management skills meet your sales skills to get a upper management buy off. I have been in smiler places where you would think common sense would pervale. The reason we have SOX (Sarbanes-Oxley) and HIPPA (Health Insurance Portability and Accountability Act) is because business dose not always want to focus on anything that dose not drive profits to the bottom line. As security professionals we are obligated to know what is the correct course of action is to protect or networks and the company. Understand BCP & DRP is very important and will only add another layer of protection to your company/client. RichM Thanks for pointing out some of the real day to day projects & tasks that are not always brought up in security forums.

Thanks RichM for the article!

Brian Wilson

Submitted to digg:

http://digg.com/security/BCP_and_DRP_from_Scratch_Saving_Your_Company_s_A_ets

Don

ohhh good article.

out of curiosity, what type of fire supression do you have in the server room?  I am guessing water, which  means you may want to have a plan in place for replacing every single server in that room and restoring the data once the water hits them.

ChrisG's comment actually happened the other day to a friend of a friend.  The fire suppression system malfunctioned and destroyed $200,000+ worth of furniture plus the water damage to the building and other assets bumping the price tag up significantly.  The insurance company will not pay up because anything over a couple hundred thousand dollars they fight over so that you have to settle a lesser claim or lose everything.  Everyday they wait for the settlement they are losing money.  They are in the process of triple mortgaging everything just to get enough stock to keep people coming in and supply the people who have already purchased.

Sometimes owning your own business is tough.  But, then again, a good BC/DRP "might" have helped.

Moral of this comment: Do not depend on the insurance company to have your best interest in mind.

Cutaway

Thanks to everyone for the kind words.

slimjim100,

It is disturbing how little business thinks about contigency planning till it is too late.  It is our job (whether we like it or not) to sell the concept.  It has been 5+ years since those horrific events on September 11th and many companies still do not get it.

ChrisG, to answer your question, our fires suppression stops and starts with handheld charged fire extinguishers.  As is more par for the course (than most will admit), our server room was at one time office space.  There are no sprinklers of any kind throughout the space, and the door to the "server room" is left unlocked b/c the space is large enough to accomodate old but possibly still usuable (in management's eyes) it equipment printers, switches, etc.

I agree though that if you do have water suppression in your server room that you absolutely need a contigency plan for replacing the hardware.  Even if you have a dry system (water is not charged in the line) once it goes off, it seems as if the cure can be much more harmful than the disease.

cutaway,

Thank you for that sobering example, I will definately carry that with me the next time someone thinks they are mitigating a considerable risk through the purchase of insurance.