MISO L008 Disaster Recovery Plan
Post on 15-Nov-2014
2124 Views
Preview:
DESCRIPTION
Transcript
Prepared by: Jan Wong
ManagementInformation
Systemsin Organizations
DISASTERRECOVERY PLAN
The Learning Outcomes
At the end of this session you should be able to:
the importance of disaster recovery in an organization
backup systems and system recovery
EXAMINE
DISCUSS
the steps in risk management approachDESCRIBE
DangerJeopard
y
Peril
Hazard
Menace
Threat RISKS
What is RISK?
Thinking about risk• Chance (probability)
of something happening
• Impact (cost) if it happens
Is it possible to protect against every risk?
“The chance of a negative outcome”
Risk Management Approach
A risk-management approach helps identify threats and select cost-effective
security measures.
Risk-management analysis can be enhanced by the use of DSS software packages. Calculations can be
used to compare the expected loss with the cost of preventing it.
A business continuity plan outlines the process in which businesses should recover from a major disaster
“What is it all about?”
What are the STEPS in RISK
MGMT.?
Assessment of assets
Determine the value and importance of assets Infrastructure:
hardware, networks, security environment itself
Software environment
Staff Cost of replacement Cost of loss of use
STEP 1:
Vulnerability of assets
List all potential threats
Review the current protection/controls system
Record weaknesses in the current protection system in view of all the potential threats
STEP 2:
Loss analysis
Assess the probability of damage
Specify the tangible and intangible losses that may result
STEP 3:
Protection analysis
Provide a description of available controls that should be considered – general, application, network etc
Probability of successful defense
The cost
STEP 4:
Cost Benefit Analysis
Compare cost and benefits
Decide on which controls to install
STEP 5:
Controls to Mitigate Risk
Intended to: Prevent accidental
hazards Deter intentional
acts Detect problems
ASAP Enhance damage
recovery Correct problems
comprehensively
IT Security in the 21st Security
Increasing the Reliability of Systems
Fault tolerance to keep the information systems working, even if some parts fail.
Intelligent Systems for Early Detection of
problems Detecting intrusion
Backing-up Systems
Why do we need to back up systems? Because systems fail
Impact From minor irritation
to business closedown
Back up system to: Periodic in Local
storage Periodic in Remote
storage Mirror site – local Mirror site – distant
Withstand fault tolerance
System Disaster – it happens!
• Think about: Loss of power Cyber crime Traumatic damage Hardware failure Statutory Requirement
System Recovery and Business
Continuity
• Is there a relationship between the two?
• Here are some key thoughts about disaster recovery by Knoll (1986): The purpose of a recovery plan is to keep
the business running after a disaster occurs Recovery planning is part of asset
protection Planning should focus first on recovery from
a total loss of all capabilities
How to ensure that the recovery system works
• Proof of capability usually involves some kind of what-if analysis that shows that the recovery plan is current
• All critical applications must be identified and their recovery procedures addressed in the plan
Disaster Recovery Plan
• In other words: BACK UP PROCEDURES
• In the event of a major disaster it may be necessary to move to another back up location.
Disaster Recovery Plan Considerations
PGM
Disaster Recovery
Plan
FacilitiesCustomers
CommunicationsInfrastructure
ComputerEquipment
BusinessInformation
KnowledgeWorkers
Disaster Recovery Plan
1. HOT SITE VENDORS External hot site vendors provide access to
a fully configured back up data center. Following the 1989 San Francisco
earthquake Charles Schwab were up and running in New Jersey the following morning.
PGM
Disaster Recovery Plan
2. COLD SITE VENDORS Provide empty office space with special
flooring, wiring and ventilation. In an emergency the affected company
moves its own or leased computers to the cold site.
These back up sites may work well for a company with centralised computing facilities but what can a company with a distributed network system do?
PGM
Methods to Control & Secure I.S.
1. Physical access control
2. Uninterrupted power supply (UPS)
3. Generator
4. Humidity control
5. Temperature control
6. Water Detector
7. Raised Floors
8. Fire Extinguisher
9. AlarmPGM
THINGS TO TAKE NOTE OFF
• Risk management approach (the 5 steps)
• What are the different risk mitigation controls?
• Types of back-up systems
• What is a disaster recovery plan?
• What should be considered in a disaster recovery plan?
M a n a g i n g S y s t e m S e c u r i t y
IT’S TIME FOR SOME DISCUSSIONS!
• List and briefly describe the steps involved in risk analysis of controls.
• Define and describe a disaster recovery plan.
• What are “hot” and “cold” recovery sites?
• Explain why risk management should involve the following elements: threats, exposure associated with each threat, risk of each threat occurring, and cost of controls, as well as assessment of their effectiveness.
• Why should information control and security be a prime concern to management?
IT’S TIME FOR ANIN-CLASS ACTIVITY!
• Get into groups of 5-6 members
• Using the Risk Management Approach (5-Steps), apply it to your company / one company of your choice as below: GSC Cinemas Ticketing / Fashion Retail (brick-and-mortar) /
IBM / Malaysian Airlines Ticketing / Hilton Hotel Reservation / Facebook
• Suggest which Risk Mitigation Control should you implement and how it can help you mitigate your risk
• Present your approach the class
C o m i n g s o o n … n e x t c l a s sManagementInformation
Systemsin Organizations
DISASTERRECOVERY PLAN
What is a disaster recovery plan? How does it minimize risk?
top related