Disaster Recovery Planning

Disaster Plan & Business Continuity Infrastructure

webmaster — Sat, 13 Jun 2009 11:06:13 -0600

The key technology elements of a Disaster Recovery Plan and Business Continuity Plan (DRP/BCP) infrastructure are the primary data center, a remote site that duplicates the resources in that primary location and the method used to get files (master and transaction) between the two sites - such as high-bandwidth network connections. The best DRP/BCP strategies follow a "redundant every-thing" philosophy throughout the data center. Multiple mainframes and servers should run in the production and backup data facilities. Then, if a component in the production system encounters problems, it immediately fails over to the local backup as a first line of defense.

Power supplies and communication links are one of the most critical components in a DRP/BCP strategy.

Maximum Tolerable Period of Disruption (MTPOD) is an issue

webmaster — Sat, 06 Jun 2009 16:03:05 -0600

The concept of Maximum Tolerable Period of Disruption (MTPOD) is an issue with the introduction of British Standard 25999-2. When applied appropriately, MTPOD will improve management's understanding of your disaster recovery business continuity program and clarifies your enterprise's recovery priorities.

BS 25999-2, Section 4 says that the goal of a business impact analysis is to "determine the impact of any disruption of the activities that support the organization's key products and services." A key aspect of determining the impact of a disruption is identifying what BS 25999 calls the "Maximum Tolerable Period of Disruption," or MTPOD. BS 25999 defines MTPOD as the "duration after which an organization's viability will be irrevocably threatened if product and service delivery cannot be resumed." MTPOD is the maximum amount of time that the organization's key products or services can be unavailable or undeliverable before its stakeholders realize unacceptable consequences.

The full application of this concept can mean rethinking how a business impact analysis is approached. While many DRP / BCP professionals start a business impact analysis by gathering data from individual departments, MTPOD forces them to first look at products and services. Disaster Recovery and Business continuity professionals should understand downtime tolerance, taking into account:

Customer expectations
Regulatory requirements
Reputational issues
Financial and operational impairment
Strategic consequences.

Based on management input, disaster recovery / business continuity professionals can propose preliminary Maximum Tolerable Periods of Disruption for key products or services within the scope of the business continuity program.

Once MTPOD is established for key products and services, the traditional business impact analysis or service. From there, the business impact analysis can either validate or disagree with preliminary MTPOD conclusions. In addition, the business impact analysis does identify the department, function and process details that are needed to achieve the MTPOD.

Perhaps most importantly, the disaster recovery / business continuity professional must understand the amount of time required to perform the process or activity in order to deliver the product or service to its key stakeholders (internal or external). This is referred to as cycle time. For example, in a manufacturing company, cycle time would be how long it takes to obtain the necessary stock, manufacture the product, and deliver it to the customer.

With an understanding of MTPOD and cycle time, the business continuity professional can identify what is commonly accepted as the core output of the business impact analysis - the recovery time objective, or RTO. RTO is the point in time following a disruption when operations must resume (at a minimum level) in order to meet downtime tolerances.

Defining a Functional Disaster Recovery Business Continuity Plan

webmaster — Mon, 01 Jun 2009 12:17:10 -0600

What makes a truly functional disaster recovery business continuity solution is the ability to restore full systems and enterprise operations quickly, in a matter of hours or even minutes, using available computing resources, which may be local, but may also be remote.

True disaster recovery and business continuity plans must allow for recovery from site-wide disasters, such as a hurricane. The primary site may be completely down, due to a lack of power and network connectivity. The secondary site located in a non-affected area would be used to restore services until the primary site comes back online.

Many enterprises opt for remote Disaster Recovery Business Continuity site(s) for such scenarios. Many system administrators opt for virtual servers, which use asynchronous replication to replicate both the data and virtual machines to the secondary site, which has several standby servers. That way if they need to activate the secondary site, they just direct the activity to the virtual machines and all the systems are back up and running with the latest data.

Template Tools for CIOs

webmaster — Wed, 20 May 2009 10:20:51 -0600

Disaster planning is an essential component of preserving your institutions collections. With a written disaster plan, libraries, archives, museums, historical societies, and other collection-holding institutions can reduce the risk of disaster and minimize losses. dPlan is perfect for small and medium-sized institutions that do not have in-house preservation staff. dPlan is also valuable for large library systems or museum campuses that need to develop separate but related plans for multiple buildings, locations, or branches.

The Janco Disaster Recovery / Business Continuity Plan Template can help you create a plan for disaster prevention and response. This template will help you:

Prepare for the most likely emergencies,
Respond quickly to minimize damage if disaster strikes, and
Recover effectively from disaster while continuing to provide services to your community.

Google flops on its conversion to IPv6 from IPv4

webmaster — Sun, 17 May 2009 10:57:48 -0600

Google flops on its conversion to IPv6 from IPv4. Widespread outages involving several Google services--including search, Google Docs, and Gmail--were caused by an upgrade gone awry inside of Google, according McAfee. The outage began at 8:13 a.m. PDT, according to McAfee's data, and was fixed by 9:14 a.m. PDT. A senior manager at McAfee said that Google attempted to make changes to key Internet routing numbers--known as autonomous system numbers--as part of its ongoing transition from an older networking standard (IPv4) to a newer one called IPv6. An unknown "bug" inside Google's network prevented Internet service providers from finding Google's new ASNs on the Internet--effectively blocking its services.

Not all Internet users were affected, but some that use larger providers--such as AT&T or Verizon--appeared to be disproportionately hurt because large ISPs "peer" with Google, or interconnect their networks with Google's networks in order to improve speed and reduce bandwidth costs. Not all customers at those providers were affected, and smaller ISPs that did not interconnect their networks were able to route around the problem.

Mid-Sized Firms are at Risk When Disasters Occur

webmaster — Fri, 17 Apr 2009 16:32:30 -0600

Many firms are inadequately protected and mistakenly think that a disaster is rare and won't happen to them anytime soon.

SMBs prioritization of disaster recovery, backup and high availability for 2008 shows that businesses understand the risks to their business and the value of protection. However, many organizations still errantly think that backup is a sufficient disaster recovery plan. But, mid-sized enterprises are at the most risk to disaster and are more likely to rely strictly on backup as a disaster recovery plan.

The needs and resources of mid-market firms are unique. Midsized companies must work with limited finances infrastructure and human resources. Robust disaster recovery used to be affordable and manageable only by large enterprises. Mid-sized enterprises relied more on backup than on a formal disaster recovery plan. As businesses' reliance on IT has grown, backup has increasingly shown its weaknesses. However, the introduction and maturation of several key technologies, such as virtualization, have brought affordable and easily implementable disaster recovery to small and mid-sized companies. SMBs do not always equate virtualization with disaster recovery because awareness of the many virtualization applications is just starting to grow.

Project plan for developing and maintaining a Disaster Plan

webmaster — Tue, 14 Apr 2009 13:48:24 -0600

There are a number of approaches that have been used by Jancos clients to create a Disaster Recovery / Business Continuity Plan. One, which several have used, is to start with the Janco Disaster Recovery Business Continuity Template and implement a seven-step process (a subset of the project plan which is included in the template) using the tools included with the template. The process is as follows:

Develop the contingency planning policy statement. A formal department or agency policy provides the authority and guidance necessary to develop an effective contingency plan.
Conduct the business impact analysis (BIA). The BIA helps to identify and prioritize critical IT systems and components.
Identify preventive controls. Measures taken to reduce the effects of system disruptions can increase system availability and reduce contingency life cycle costs.
Develop recovery strategies. Thorough recovery strategies ensure that the system may be recovered quickly and effectively following a disruption.
Develop an IT contingency plan. The contingency plan should contain detailed guidance and procedures for restoring a damaged system.
Plan testing, training and exercises. Testing the plan identifies planning gaps, whereas training prepares recovery personnel for plan activation; both activities improve plan effectiveness and overall agency preparedness.
Plan maintenance. The plan should be a living document that is updated regularly to remain current with system enhancements.

Backup Service Providers May Not Be Enough

webmaster — Sun, 05 Apr 2009 15:52:29 -0600

Your data is only as safe as its most recent backup. But what happens when you have worked on your laptop with enterprise critical data and it is lost or damaged. You data is only as redundant as the integrity of the data that you have stored on your servers, but in this case you may have a compliance issue that you have not addressed. For companies that service customers in the cloud, if they cannot offer 99.9999% uptime and absolutely ensure data backup and restoration, they might as well not be in business.

There are a few issues at hand here. Not only must the backup provider ensure that the data is accurately and securely backed up whereby every packet and byte is accounted for, but you must also ensure that when the time comes, the data is "clean" enough to be plugged back into the system without a hiccup. It's the hiccup that companies need to avoid which is why they look for ways to backup their data to begin with, however they aren't always as proactive as the results they were expecting.

Disaster Recovery Business Continuity for Remote Offices

webmaster — Tue, 24 Mar 2009 23:33:52 -0600

Data residing outside the data center at remote and branch offices (ROBOs) accounts for a significant portion of an enterprise's information store, yet it often either is protected with inefficient backup processes or is not protected at all -- leaving companies at risk on many fronts.

In a recent research report, high priority projects for ROBOs included improving information security measures; ensuring compliance with government, industry or corporate governance mandates; and improving Disaster Recovery Business Continuity processes.

Encryption and Disaster Recovery Planning

webmaster — Fri, 20 Mar 2009 11:19:07 -0600

Common data encryption rules are a requirement and represent interoperability when developing your backup strategy for your disaster recovery business continuity plan. When enterprise protect data at rest such as when a USB drive is unplugged, or when a laptop is powered down, or when an administrator pulls a drive from a server, it cannot be brought back up and read without first giving a cryptographically-strong password. If you do not have that, the media is a brick and you cannot even sell it on eBay.

For enterprises rolling out security across PCs, laptops and servers, standardized hardware encryption translates into minimum-security configuration at installation, along with higher performance with low overhead. The specifications enable support for strong access control and, once set at the management level, the encryption cannot be turned off by end-users.

Required Processes	Recommended Solution	Cost
Implement formalized security policies and procedures	Security Manual Template
Audit access to databases and network	Security Audit Program
Monitor network activity to identify unusual activity	Network Event Viewer
Monitor user activity to identify unusual activity	Smart Disk Monitor
Archive logs to meet compliance requirements	Text Log Monitor
Automate monitoring	Network Event Viewer Smart Disk Monitor Text Log Monitor Internet Service Monitor

DHS Stresses Need for Communication Capability in Disaster Recovery

webmaster — Fri, 06 Mar 2009 10:18:31 -0600

The Homeland Security requirements for communications interoperability include:

Ability of agencies to talk across disciplines - via voice, data, image, video, or multimedia that include multiple forms of information.
Ability to communicate and share information as authorized when it is needed, where it is needed, and in a mode or form that allows the practitioners to effectively use it.

Since a disaster or business interruption event or incident can happen anywhere, key staff members must have data communications on the scene, as well as away from the scene (at home), for command control and information to complete their missions. Homeland Security requirements have recognized the need for temporary networks that can form automatically on-scene among first responders. Temporary networks must be able to integrate with larger temporary or fixed networks, but need to be independent of fixed infrastructure in case the latter is disabled. Because disaster or business interruption scenes often expand as incidents develop, temporary networks need to be capable of expanding easily with the scene.

Cost of Computer and System Outage

webmaster — Tue, 24 Feb 2009 15:41:33 -0600

In today's highly difficult and competitive business environment, computer and information system outages can be devastating. Regardless of the cause - hurricane, fire, accident, hacker attack, or even terrorist attack - production system and computer downtime is not only costly, but in some cases ruinous. With a mobile workforce, global customers wanting to do business around the clock, and continually greater dependence on technology, companies need to not only protect data, but also continue business operations virtually uninterrupted. The cost of downtime, depending on your industry, can be from thousands to millions of dollars per hour - due not only to disaster recovery expenses, but also to lost sales, customer defection, and lack of productivity. Add to that a damaged reputation in the marketplace and diminished shareholder confidence, and the cost of downtime can be staggering.

Maintaining productivity during a business interruption

webmaster — Wed, 18 Feb 2009 15:17:49 -0600

Enterprises are being forced to take a new look at their business continuity and disaster recovery plans because of the prospect of business closures, terrorist attacks, and/or pandemics - epidemics affecting wide geographical areas for weeks or months.

Planners are contemplating new scenarios, in which massive closures in business along with a major disaster like a terrorist attack or a pandemic that limit travel and prevent workers from congregating in offices.

The striking new challenge is how to maintain employee productivity when the workforce is confined to their homes or other remote locations. The question is how can a company go from 10% of its employees working outside of the office to 80%?

Key issues facing enterprises that might need to turn office workers into mobile workers, rapidly and in large numbers include:

The technical and human challenges of supporting business processes during and after the business interruption event.
The planning required.
Procedures to equip employees with the information and technology to remain productive.
Potential impact on the infrastructure and on support staffs.

Each of these is addressed in the Disaster Recovery Business Continuity Template published by Janco Associates.

Outsouring Can Help in Disaster Recovery Planning

webmaster — Sat, 24 Jan 2009 16:38:06 -0600

Between hackers, natural disasters, or even a pipe breaking in the office above yours, every business needs a contingency plan. It could mean the difference between riding out a problem and going out of business. For this reason, most businesses are concerned about the safety of their backups. Data loss is a significant concern for any business - and in healthcare and other industries can have huge financial consequences. Soltions typically require that you spend more money on a third party backup solution.

What is the optimal method of back up for an enterprise's disaster recovery plan?

webmaster — Fri, 16 Jan 2009 13:22:23 -0600

The Backup and Backup Retention policy is an 11 page sample policy that is a complete policy which can be implemented immediately.

The document is provided in both Word 2003 and Word 2007 format and is easily modified.

*Solution*	*Benefit*	*Cost*
Local Backup	Shorter backup times Reduced bandwidth	More hardware and staff Security risks
Central Backup	Less hardware and staff	Increased bandwidth costs Increased backup times
Central Backup	Shorter backup times Reduced bandwidth Less hardware and staff	One-time technology investment

Impact of Going Green On Disaster Plan

webmaster — Thu, 15 Jan 2009 14:20:12 -0600

Disaster planning and business continuity planning are often impacted by green initiatives undertaken by enterprises. One of the prime areas that CIOs often focus is power consumption. When these are looked at, at least five (5) areas are impacted.

Data centers
Desktops
Working at home
Services and processes for customers
Services and processes for suppliers and affiliates

These have to be considered and included in the disaster recovery and business continuity plan. The question that also has to be answered is what the cost impact in troubled economic times is.

Disaster and Business Continuity Control Points

webmaster — Tue, 30 Dec 2008 10:48:12 -0600

When selecting the physical infrastructure in which to deploy IT equipment for your remote offices disaster recovery and business continuity plan demand that you consider and IT equipement location as a data center and you will to consider these five controls:

Access control - Open racks leave equipment vulnerable to accidental or intentional misuse. Enclosures with locking entries provide physical protections from unauthorized access and other environmental hazards, and permit more deployment options.
Temperature Control - Central air conditioning can only go so far in overcoming the heat output of rack server environment. Enclosures can be equipped with fans to keep temperatures within acceptable levels throughout the equipment.
Power Control - Power protection and battery backup can be provisioned in compact units to protect servers and enclosures from power problems.
Cable Control - Look for options that provide for a neat, well-organized arrangement of cables that will not impede airflow or enable cables to be accidentally unplugged.
Flexibility Control - The server environment should accommodate rack-mounted or shelf-mounted equipment, linking of bays into larger units, graceful management of unused space, and the option to roll the entire unit to another location as needs change.
Management Control - IT equipment is expected to run unattended most of the time. A monitoring/management system provides good visibility and control of the IT environment from anywhere, over the company network.

Guidelines for Disaster Recovery and Business Continuity Planning

webmaster — Wed, 10 Dec 2008 13:33:49 -0600

Disaster recovery and business continuity are important business issues that require awareness and planning. Guidelines that can be used in this process are:

Look at the big picture your business processes, systems, networks, data, and people all need to be considered when planning and implementing these processes.
Understand your levels of tolerance for lost work, missing data, and unproductive time.
Document and test your plans, and update them when business needs change.
Configure your environment to minimize the likelihood of a failure escalating into a disaster.
When evaluating technology solutions, take into account meeting your recovery objectives, kinds of disasters youre likely to face, and levels of cost, complexity, and disruption involved.
Know the advantages and limitations of each technology, and adjust your expectations accordingly.
Remember that backing up your data is the most reliable form of protection, without which your business is vulnerable.

Why Have a Disaster Plan

webmaster — Wed, 03 Dec 2008 12:56:20 -0600

In the event of a disaster, will your enterprise have the ability to pick up the pieces and get back to work, or will things grind to a halt? While it isn't possible to plan for every event, a solid disaster recovery plan can make all the difference. A disaster recovery plan is one of those difficult but necessary aspects of a successful business.

The first step to crafting an individual disaster recovery plan is mapping out the most critical aspects of day to day business. If a great deal of time is spent communicating with clients over the phone, then a backup phone system needs to be addressed. This can be as simple as having employee cell phones, so that if the office's land line is damaged, workers can call clients using their cell phones. It may also be as complex as having a backup call center located in another state, so that traffic can be routed to another location if problems arise at a certain call center.

Data safety is a crucial and overlooked aspects of disaster recovery. Being able to call your customer and clients on another phone system is little help if you do not have a list of customers and clients, their orders, and their phone numbers. You cannot take new orders if you do not have access to your inventory system or are unable to put in new shipping orders. Data disaster recovery often includes making frequent backups of all critical data and records, both digital and hard copies, and storing them in a secure, remote location.

It is also important to keep in mind the time frame for disaster recovery. If your company needs to be able to recover almost instantly from a disaster, much more complex and redundant steps must be taken than if you have the ability to spend more time recovering. If your company works in a real time, online environment, you need multiple backup systems standing by so that, in the event of a disaster, they can instantly come online. If your company works in longer time frames, then allowing for several hours or days to recover records, organize documents, and resume work may be acceptable.

In the event of a disaster, will your business have the ability to pick up the pieces and get back to work, or will things grind to a halt? While it isn't possible to plan for every event, a solid disaster recovery plan can make all the difference. A disaster recovery plan is one of those difficult but necessary aspects of a successful business. With luck, you may never need to rely on your disaster recovery plan, but if you ever do, you'll be glad that you planned ahead.

Roles in Developing a Disaster Recovery Plan

webmaster — Thu, 20 Nov 2008 16:26:58 -0600

The disaster recovery policy must be reviewed at least annually to assure its relevance. Just as in the development of such a policy, a planning team that consists of upper management, and personnel from information security, information technology, human resources, or other operations should be assembled to review the disaster policy. Roles and responsibilities of the planning team should be as follows:

Perform an initial risk assessment to determine current information systems vulnerabilities.
Perform an initial business impact analysis to document and understand the interdependencies among business processes and determine how the business would be affected by an information systems outage.
Take an inventory of information systems assets such as computer hardware, software, applications, and data.
Identify single points of failure within the information systems infrastructure.
Identify critical applications, systems, and data.
Prioritize key business functions.

The Disaster Recovery Plan Template has tools that can be used immediately and defined in detail all of these responsiblities and provides a work plan that can be use as is.

What Should a Data Center Disaster Plan Have

webmaster — Tue, 11 Nov 2008 13:46:27 -0600

What should a Data Center Disaster Plan Have? Janco has found that a go Disaster Recovery Plan should have:

A section that describes the strategy and procedures for recovering Data Center processing of applications should a disaster substantially disrupt operations.
The disaster recovery plan should ben organized into three parts: the main body which provides a general description of the disaster recovery strategy and program, the appendices provide detailed information for conducting the recovery, and the attachments provide supplemental information. The main body is public information and may be freely distributed; the appendices and attachments contain sensitive information that is restricted to the individuals responsible for recovering Data Center operations. The appendices and attachments must be destroyed when updated versions are received.
The plan is frequently updated to reflect current hardware, software, procedures, applications, and staffing. Revisions are distributed to the disaster recovery team members at least twice a year following the disaster recovery tests.

There is More to Disaster Planning Than Creating Backup Files

webmaster — Wed, 29 Oct 2008 00:14:09 -0600

The definition of the necessary level of data backup and restoration processes are crucial components of business continuity and disaster recovery planning. But they are not the only factors that the enterprise and its IT organizations need to consider when defining the strategy they will use in protecting critical data against various disasters including unforeseen events such as severe weather, natural disasters or power failures. They also need to take into account applications, servers, networks, communications, work spaces, and the people who run the applications.

How can organizations effectively evaluate their business continuity needs and ensure that the technologies in place are effective? One key step is to conduct a business impact analysis which examines all the business functions and assesses the damage if a function suffers outages. Storage systems - and more specifically the data thats stored in them - are extremely relevant for business continuity. But so are the applications, servers, networks and people who run the applications.

Metric for business continuity and disaster recovery include timelines for recovery point objectives (RPOs) and factors defined as recovery time objectives (RTOs). For data to be available when needed, it needs to be replicated to a remote site. Depending on the desired RPO, that could be synchronous or asynchronous data transfer. In some cases it could be a combination of data that is replicated synchronously to a location that is geographically close and then asynchronously replicated to an out-of-region recovery center.

But data is only part of the equation. Servers, networks and other IT components also play a major role. Just having the data replicated might be okay for a disaster recovery environment with longer acceptable recovery time objectives. The high cost of storage, communications, network access, and software replication are just a few of the challenges in implementing adequate business continuity. For a complete real business continuity plan, more than just the data needs to be replicated and available at a secondary site - employee workstations, communication, servers, and applications need to be available. Only with a complete business continuity and disaster recovery plan and strategy in place can organizations ensure continuous operation of the enterprise and availability of vital information.

Risk Assessment is First Step in Disaster Recovery and Business Continuity Planning

webmaster — Wed, 22 Oct 2008 04:35:04 -0600

The first step in creating a disaster recovery plan (see Disaster Recovery Plan Template Business Continuity - http://www.e-janco.com/DisasterPlanning.htm) is conducting a risk analysis of your business operation, (see Threat Vulnerability Assessment - Sarbanes Oxley
Compliance Tool - http://www.e-janco.com/threat.htm) computer applications, and your computer systems. List all the possible risks that threaten the continuity of your business operations, system uptime, and evaluate how imminent they are in your particular IT entity. Anything that can cause a system outage is a threat, from relatively common man-made threats like virus attacks and accidental data deletions (most common occurrence) to more rare natural threats like floods and fires. Determine which of your threats are the most likely to occur and prioritize them using a simple system: rank each threat in two important categories, probability and impact. In each category, rate the risks as low, medium, or high.

For example, a small distribution company (revenues of $25,000,000) located in Florida could rate a hurricane an high probability with a high impact, an earthquake threat as low probability and high impact, while the threat of utility failure due to a power outage could rate high probability and high impact. So in this company's risk analysis, a hurricane and power outage would be a higher risk than an earthquake and would therefore be a higher priority in the disaster recovery plan.

Disaster Recovery Communication Requirements Defined

webmaster — Sat, 18 Oct 2008 09:25:05 -0600

Disaster Recovery Planning requires a communication network in place that meets at least the following requirements:

Voice: It would be absolutely essential for disaster recovery personnel to communication with one another on a common voice channel. A useful service in this regard is provided by the push-to-talk voice call system that has been incorporated by the GSM standard in its Phase 2+ version as an additional service. The push-to-talk system enables an almost instant voice connection to be setup between the speaker and the intended call recipients, thus saving precious time in emergency situations.
Data: Disaster recovery personnel at the disaster site must be able to exchange data with the Remote Command Center in real time. Further, the personnel must be able to exchange data with one another. Lastly, they should be able to connect to the public internet and possibly to a remote third party via a secure link.
Location information: Each of the disaster recovery personnel at the disaster site must be able to see the locations of all other active personnel in a specified area, relative to their own positions. This service may prove crucial in situations where in a worker want to warn nearby workers of dangerous conditions (e.g. collapsing buildings after an earthquake) or wants to request backup for immediate help in rescuing disaster victims.

Staff Training Critical for Business Continuity

webmaster — Tue, 30 Sep 2008 12:49:35 -0600

A statistic that may be alarming to those with remote locations who may not be properly managing the storage at those sites is that up to 80 percent of the information deemed "important" to "critical" for the average multiple-location business resides in their branch offices. That means the office manager, salesperson, or computer-savvy marketing guy is responsible for 80 percent of the companys future! Whether that person takes vacation, business trip, gets too busy or simply forgets to perform the nightly backup, your data is at risk.

Even if the job is assigned to the most responsible person in the entire company the person whos always around there's no guarantee that the job will be done correctly, consistently, or in a timely manner across sites. The office manager at one site may have a different method than the inside sales representative in another location. The marketing manager at a third site may perform the task with less consistency than the other two.

Recovering Water Damaged Documents After a Flood or Hurricane

webmaster — Wed, 24 Sep 2008 13:45:42 -0600

The critical decisions that have to be made following water damage require knowledge of available drying technologies and their effects on a variety of composite materials. Ideally, materials removed from site, should be prepared and packed in a manner most suitable for the drying method to be used. Unfortunately, what tends to happen, particularly when no emergency plan exists, is that wet material is packed and shipped off to freezing facilities without knowledge of how the material will be dried. This may result in the material having to be re-packed before drying which adds considerably to the cost of drying and the potential for further damage.

The complete restoration of water-soaked documents, particularly bound items, can be a costly process even under the most favorable conditions. In the majority of cases, the high costs involved do not justify the salvage and restoration of books which are in print and can be replaced. However, decisions relating to these factors are virtually impossible to make during a salvage operation and even when a disaster plan exists. On the other hand it might be unwise not to attempt to salvage everything, if an insurance assessment is required and a claim is to be made.

Many CIOs and CTOs are Having Sleepless Nights

webmaster — Wed, 03 Sep 2008 12:26:04 -0600

In today's enterprise environment, the amount of digital data being created and stored is growing at an ever increasing rate. Enterprises are not only relying on IT to drive the quality and efficiency of key functions such as customer support and manufacturing; they are also being directed by regulatory requirements to retain vast amounts of information while at the same time protecting that data from inadvertent disclosure and/or theft.

To help maintain business continuity and mitigate the risk of disaster or litigation, enterprises must have the ability to retain, protect, and recover ever-increasing volumes of data quickly, flexibly, and cost-effectively. It is no longer enough to have an adequate backup and recovery process in place to access data and restore enterprise operations in the event of a disaster, outage, or accidental loss. Today, organizations also need a disaster recovery and business continuity strategy designed to ensure that they can retain and manage data over the long term to satisfy regulatory, auditing, litigation, and other data management requirements.

All too often, enterprises that do implement backup and recovery systems end up with a mix of complex and costly storage and network technologies that require a wide range of specialized skills to operate. For example, many backup and recovery systems include legacy disk and tape drives, storage area networks (SANs) and Fiber Channel networking, and other technologies such as network attached storage (NAS) and Ethernet networking. This only complicates the Disaster Recovery and Business Continuity Process.

That taken in account with the fact that over one third of all enterprises have had to activate their Disaster Recovery / Business Continuity Plans in the last few years is costing many CIOs and CTOs with many sleepless nights.

What Is The CSO's Role

webmaster — Fri, 15 Aug 2008 14:16:46 -0600

What is the Chief Security Officer (CSO)? The title Chief Security Officer (CSO) was first used inside the information technology department and function to identify the person responsible for IT security. At many enterprises, the term CSO is still used in this way.

The CSO title is also used in many enterprises to describe the leader of the "corporate security" function, which includes the physical security and safety of employees, facilities and assets. This individual often holds a title such as Vice President or Director of Corporate Security. Historically, corporate security and information security have been handled by separate departments.

The CSO is the executive responsible for the organization's entire security posture, both physical and digital. CSOs also frequently own or participate closely in related areas such as business continuity planning, loss prevention and fraud prevention, and privacy.

At a tactical level, technology is being infused into physical security tools, which are increasingly database-driven and network-delivered. At a strategic level, CEOs and corporate boards, motivated in part by regulations such as the Sarbanes-Oxley Act, HIPAA, and ISO 27000 (formerly ISO 17799) 27001 & 27002 standards, desire an enterprise-wide view of operational risk.

The Chief Security Officer (CSO) is responsible for overall direction of all security functions associated with Information Technology applications, communications (voice and data), and computing services within the enterprise. At the same time the CSO must be aware of the implications of legislated requirements that impact security for the enterprise. This includes but is not limited to Sarbanes Oxley Section 404 requirements.

The CSO has the responsibility for global and enterprise-wide information security; he/she is also responsible for the physical security, protection services and privacy of the corporation and its employees.

Steps to Create a Disaster Recovery and Business Continuity Plan

webmaster — Thu, 07 Aug 2008 09:02:10 -0600

The steps to create a workable Disaster Recovery and Business Continuity Plan are:

Assessment the environment
Determine capabilities and capacities of the enterprise
Develop a preliminary work plan with detail action items
Prioritize activities to develop the plan
Define deliverables
Obtain approvals and budget to develop the plan
Assign responsibilities
Implement a status reporting process
Develop initial Disaster Recovery and Business Continuity Plan
Review and modify plan with operating groups and management
Test plan

Backup Policy for Active Directory Defined

webmaster — Fri, 01 Aug 2008 11:08:41 -0600

Active Directory is the gatekeeper to the network resources your employees depend on, so Active Directory is critical to your business. Accordingly, having a reliable and practiced set of recovery strategies is vital. Preparing for a catastrophic event - for example, a hardware failure or physical disaster is necessary, but so is preparing for "everyday disasters." Problems can arise in the normal course of day-to-day operations from a variety of causes, including:

Human error - an administrator might delete an entire organizational unit (OU) instead of a particular user, or accidentally delete a service account, which could affect hundreds of users.
Unexpected consequences - an administrator might use a script to set one of the Extension Attributes in Active Directory only to find out that Extension Attribute contained data for another mission critical application that wont work anymore because of the changes. The data must be restored as soon as possible.
Malicious activity - both current and recently-terminated employees, as well as external service providers, might find ways to access your sensitive systems and data, and their knowledge can enable them to cause significant damage. According to Entrepreneur, "four out of five IT-related crimes are committed from within an organization". Moreover, CSO Online reports that "inside security breaches affect 49% of companies". Once your network is under attack, it's too late to plan - you need to have your diagnostic and recovery tools in place.
Viruses - Viruses can damage Active Directory data, and the replication process propagates those unwanted changes. Anti-virus software, of course, provides protection, but it is critical to be able to respond quickly to viruses that get through.

What To Do When Disaster Strkes

webmaster — Fri, 18 Jul 2008 10:55:34 -0600

A natural or man-made disaster can strike anywhere, anytime, with ruthless and devastating results - that's the awful essence of a disaster.

Hurricane Katrina and the Sept. 11, 2001, attacks loom large in the collective memory for the magnitude of their destruction, but smaller-scale, localized disasters happen all the time: a fire in a building, human error that erases a server, a power outage in a town. Each can wreck a business in minutes and is much more likely to happen than a terrorist attack or a hurricane.

As gloomy as those scenarios may be, the name of the game for companies is "prepare for the worst; hope for the best." Companies can minimize the worst possible disruptions to their businesses and the lives of their employees by creating disaster recovery and business continuity plans. Such plans are not just for large and well-connected companies, but for small and midmarket companies as well.

These plans can protect company data and applications, and they can have a company back in business within 48 hours or less after a disaster. That's where Janco's Disaster Recovery / Business Continuity Template comes into play. The Templates provice the expertise to help companies craft their plans and then flesh out those plans with technology solutions.

Disaster Causes Many Businesses to Close Doors Forever

webmaster — Sun, 06 Jul 2008 05:34:46 -0600

Consider this, almost 40% of small businesses that close due to a disaster event never re-open. What would you do if the building your business is located within was damaged or destroyed in a disaster? Where would you go to continue providing your customers with your business services? Would you be prepared and have the correct resources, databases, contact information and other necessary items to adapt to these changes? Having a disaster plan that identifies these important items will help ensure your business is prepared to survive during unexpected and difficult times!

As historic floodwaters start to recede along the Mississippi and other Midwestern rivers, local businesses in affected communities like Cedar Falls, Iowa, are busy assessing the impact on IT equipment and whether disaster recovery plans stood the test.

A maker of computer games in Cedar Falls, may be permanently displaced after Cedar River floodwaters reached 6 feet in its administrative offices and 5.5 feet in an adjoining warehouse. The company sustained about $250,000 in damage to inventory.

The firm's president said all 65 employees are now working temporarily in borrowed offices in three facilities.

As the floodwaters approached on June 9, employees scurried to save 120 PCs, 80 monitors and eight servers. Three high-end printers could not be removed in time.

The company plans to revise his disaster recovery plan. "When a river comes up 6 feet higher than it ever has before, it's tough to have that foresight," they said. "But it is probably going to happen again."

A software development company has plans to deal with tornados and electrical outages, but executives never dreamed they would have to contend with the Cedar River surpassing 500-year-flood levels. "Going through this experience [will] make those plans [more] than just part of an IT checklist," he said.

A key lesson learned was that companies must prepare for employees to miss work to help families and communities after natural disasters.

Amazon Business Continuity Problems Are a Reality

webmaster — Wed, 11 Jun 2008 11:41:29 -0600

Amazon suffered some disaster recovery and business continuity issuse as online shoppers struggled to enter Amazon.com's main e-commerce site for the second time in two days.

Only about 30% of visitors managed to enter Amazon.com, according to mobile and Internet management firm which tracks Web site performance.

The problem was not limited to the US as Amazon's U.K. storefront had similiar problems.

The U.K. site first experienced problems when its availability dropped as low as 38%.

Amazon said, "Some customers reported intermittent problems accessing Amazon retail Web sites. Amazon is working to resolve the issues, and Amazon's Web services are not affected."

Average load times jumped to 15 seconds versus 6 seconds.

During the period of site unavailability most shoppers having access problems got the cryptic error message "Http/1.1 Service Unavailable, which means little to nontechnical people. That message indicates that whatever caused the problem proved hard to isolate, making it impossible for the company to configure its system to trigger a more intelligible alert acknowledging the problem in plain English.

The more complex a system is, the more challenging it is to maintain, and a configuration problem here can cause problems somewhere else.

Data Loss a Real Disaster Planning Concern

webmaster — Wed, 28 May 2008 14:33:48 -0600

Consider the Herculean efforts today to protect the network from threats: Intrusion prevention systems scan packets for potentially damaging content; email security systems check for viruses in email content and firewalls block unsolicited connections. To stop the onslaught of threats to corporate and government networks, a host of software and appliances are being deployed daily . In general, these border police applications are doing a fairly decent job of stopping unauthorized intrusion at the door to your network.

But what about organizational insiders? Which applications or appliances are scrutinizing the information being passed out of the network? Intrusion prevention systems and firewalls arent looking for intellectual property sliding out the door right under their virtual noses. Specifically in healthcare organizations, what about patient information sent unprotected over the Internet to another provider? Add in the always-changing regulatory environment, and security is a unique challenge. All it takes is one misstep to compromise sensitive information. These are legitimate, authorized users communicating in an above-board way but potentially exposing sensitive data in the process. This is the core of the immensely complex problem of data loss.

Data Bacup Takes Bandwidth

webmaster — Tue, 13 May 2008 12:37:36 -0600

Whether backing up remote data onto centralized tape or disk backup systems, or replicating company assets between redundant data centers, wide-area data services (WDS) solutions enable organizations to move data between sites without the constraints of distance and throughput. One optimization system accelerates applications typically by five to 50 times and in some cases up to 100 times faster than conventional transport mechanisms with up to a 95% reduction in WAN bandwidth utilization.

What is a Disaster?

webmaster — Thu, 01 May 2008 16:01:56 -0600

(Computerworld) Disaster planning traditionally focuses on three variables: data center replication, building design and backups. Analysts have maintained for years that the most common disaster is outright hardware failure because of faulty data center design, for instance, when the emergency power off button is hit, either accidentally or on purpose. Yet, for many enterprises throughout the U.S., the reality is that recovery plans should be customized for whichever type of major disaster is most likely to occur in any given area.

There are really two kinds of disasters that can affect your data center, says the executive director of The Uptime Institute in Santa Fe, N.M. Those that do not affect your data center directly but do affect your region. Another is a disaster that affects your building directly; you will not recover until you recover the building. One of the most important decisions, but one that is often given little thought, is where to put the data center.

Backup Window Must be Planned For

BackupWindow@e-janco.com — Fri, 25 Apr 2008 15:23:05 -0600

Rather than add more bandwidth, or invest in expensive, dedicated storage networks, WAN optimization can improve IP network performance sufficient to turn recovery into continuity. To help meet the objectives outlined above, a WAN optimization solution must be able to do three separate tasks for true business continuity: restrict bandwidth to backup applications during the allowed window and allocate it to critical applications in the event of a disaster, overcome latency and bandwidth limitations on the wire, and provide acceleration to roaming or displaced users redirected to alternative data sources.

Regardless of whether the data is being replicated from a massive cabinet, over IP-based storage or off a users hard drive for compliance purposes, during the backup window maximum bandwidth should be available to ensure completion. This requires granular bandwidth management that can isolate applications on the network and provide a predictable, policy-based service level. Further, the solution should be able to distinguish between a user initiated file copy and one started by the backup daemon, and apply different bandwidth allocations to each.

Also, the solution must remove latency and protocol inefficiencies that constrain current WAN backups. Caching and compression technology combined with inline protocol optimization of commonly used file transfer protocols form a technology suite that improves the performance characteristics of a WAN, adding bandwidth and reducing the time needed to complete backups and restores. Moreover, it should be able to do this for individual devices and accommodate displaced and roaming users without the need for bulky appliances.

How minimize your backup exposure

webmaster — Sun, 13 Apr 2008 18:04:54 -0600

Are you taking the right steps, or could you reduce your backup window further?

Are you setting the right data protection goals?
Have you established the best benchmarks?
How can you optimize your backup model to meet your SLAs?
Have you projected your data growth accurately?
Will your technology fit all your needs?

To accomplish this you should:

Set data protection goals based on buisness needs
Establish performance benchmarks
Optimize backup performance to exceed your benchmarks
Forecast the capacity needs for both hardware and software
Build a modular data protection architecture

Disaster Recovery and Compliance

webmaster — Sat, 22 Mar 2008 08:30:08 -0600

Disaster recovery and remote backup strategies need to take into account not just technical issues, but also how to implement those strategies within the letter and spirit of applicable legislation. CFOs and CIOs need to take care that a seemingly simple plan for disaster recovery does not in turn create a potential legal disaster. A compliance-based managed services provider (CMSP) can reduce risk and cost for many businesses.

Real World Disaster Recovery Tools

webmaster — Sat, 15 Mar 2008 06:16:03 -0600

Does your datacenter have the right procedures and equipment in place to recover your business from a disaster? Can your business survive extended downtime without your computing resources? Is your company prepared for a planned D/R event? What about an unplanned event? Janco and it template have helped hundres to recover from both types of events. The Disaster Recovery Planning / Business Continuity Template provides a place to start when considering D/R preparations for your organization.

What Telephone Service Will You Have After the Disaster

webmaster — Wed, 05 Mar 2008 14:19:18 -0600

The telephone industry is facing a very interesting quandary. On one hand, all-fiber builds offer elegant solutions and robust triple- and quadruple-play possibilities. Verizon clearly is opting for this approach. However, a good deal of money can be made by leveraging existing copper, though the resulting service platforms are more limited. AT&T is mixing its approach. The company released interesting results about its U-Verse fiber-to-the-node (FTTN) deployment at the Merrill Lynch Communications Services Forum this week. The company expects weekly customer additions to increase from 12,000 to 40,000 by the end of the week. That wasn't the only number of note. John Stankey, the president of the company's telecom operations said 60 percent of the new video customers are coming from cable operators, a percentage that exceeds expectations.

Disaster Planning Requires Security Experts

webmaster — Fri, 29 Feb 2008 10:11:13 -0600

New research from CompTIA shows that security is seen as the most desirous IT skill worldwide, and many companies find their in-house security skills lacking.

When it comes to hiring qualified IT professionals, a large portion of U.S. companies want more highly skilled workers, especially in the areas of security, networking and operating systems.

For established countries like the United States, security was by far the most important skill requested, and the skill most likely to be lacking.

The study found that while 73 percent considered security skills like firewalls and data privacy most important, only 57 percent considered those skills adequate. Other security skills considered critical included data protection, regulatory compliance and identity management.

Cracking GSM Phone Security - Disaster Recovery Implications

webmaster — Fri, 22 Feb 2008 12:57:58 -0600

(TechWorld.com) Two enterprising researchers claim to have figured out a way to eavesdrop on calls made using GSM mobile phones, cracking open its much-vaunted encryption.

GSM calls can now be recorded over long distances and cracked open in half an hour using only $1,000 worth of field-programmable gate array-aided computer equipment and a frequency scanner.

Although GSM's 64-bit A5 stream cipher has been theoretically vulnerable for some time, this is the first time anyone has demonstrated a way of doing it without investing in expensive, specialized equipment and without it taking years.

If one spends $100,000 on hardware and the crack can be done in only 30 seconds using massively parallel processing technology. Pico Computing Inc., is now developing the fast version to sell to agencies such as law enforcement, but plans to give away the slower version for free.

GSM is used all over the world by mobile phone companies, and is used in the U.S. by several networks, most notably AT&T and T-Mobile. It is considered to be secure enough that even criminals use it, simply cycling phones to avoid the theoretical risk of being tracked.

The attack depends on exploiting a vulnerability in the way GSM sets up calls. Assuming attackers were able to find out a phone's mobile subscription identification number and built-in hardware ID -- garnered by sending a text message to that phone, say -- they would have enough information to isolate calls from that phone.

Because networks set up some frames of the call security exchange using the same plain text scheme, throw enough hardware at the problem and the encryption can be forced open by using mathematical tables. "f we know the plain text, we can derive exactly what is coming out of A5.

What if Your UPS Failed Today

webmaster — Tue, 05 Feb 2008 17:03:19 -0600

Most people do not even know they have a bad battery until it's too late. If your battery is 3-4 years old, you need to look at replacing it. When a disaster occurs UPS vendors will be in short supply and will not be able to deliver all of the units that are required. Part of your Disaster Recovery Plan needs to have spares in place before the diasaster occurs.

Energy resources are becoming scarcer and more expensive, making electrical efficiency in the data center an increasingly important consideration. When selecting large UPS systems for your data center, number of significant but often overlooked factors can increase your total cost of ownership due to operational inefficiencies.

What is the total cost of a world class Disaster Plan?

webmaster — Sun, 27 Jan 2008 13:42:34 -0600

Business continuance and disaster recovery always sound great, that is, until management takes a look at the dollars involved. While it can be somewhat easy to justify the costs involved in providing complete duplication of a few key mission critical servers and applications, it becomes much more difficult to justify the next tier of applications requiring duplicate hardware for disaster recovery protection.

The first step the company took when it was formulating its plan was to calculate potential dollars lost.

If a natural or manmade disaster prevented it from shipping equipment its customers, the disaster would cost the company about $xx millions a day. That potential loss was then weighed against the $500,000 a year it costs to use disaster recovery services.

New Blades Could Ease DRP Planning

webmaster — Fri, 25 Jan 2008 11:56:51 -0600

A string of new blade server systems promises to hit new heights in processing capabilities, energy efficiency and ease of use, producing even more choices for enterprise users in what is turning into an increasingly crowded field. The latest entry comes from Dell, which introduced the new PowerEdge M1000e rack enclosure that the company claims can be installed and operational within 15 minutes. The 10U rack can hold up to 16 half-height blades, including the M600 and M605 units outfitted with quad-core Xeon or Opterons. The M1000e will replace the outgoing M1955 enclosure, although it will use the same OpenManage toolkit. IBM has added a new Power6 blade to its line-up, the JS22 Express, which matches a pair of the dual-core processors engineered with the Advanced Power Virtualization system to host up to 10 virtual servers per core. Unix users might be interested in the system's Live Partition Mobility feature that enables live migration of operating systems and applications among servers.

Disk to Disk (D2D) Could be a Qucik Solution for Disaster Recovery and Business Continuity

webmaster — Tue, 15 Jan 2008 14:37:35 -0600

The last few years have seen a number of information technology trends converge, transforming disk-to-disk backup (D2D) from something merely feasible into an attractive addition to the IT portfolio.

D2D technology brings many key benefits to your IT infrastructure, including shorter backup windows, faster restores, quicker nearline access, investment protection by leveraging existing tape hardware, and better backup economy through incremental backups.

For several decades, tape drives and tape media have been the preferred enterprise backup solution. But now, modern backup software supports writing to a disk file as though it was another backup device. Often this is implemented by emulating a tape device with special characteristics, allowing the disk file to easily integrate into the rest of the existing software architecture. The common term for this is virtual tape. Some backup software also supports the creation of multiple emulated devices and combining them into virtual tape libraries, referred to as VTL. D2D backup uses these virtual tapes to save backup data by writing to the VTL, and restores the backup data by reading from the VTL. Using hard disk drives as the underlying storage media brings all the advantages of random access, high volume manufacturing, disk reliability, RAID, and familiar technology.

Disaster Planning Considerations

webmaster — Thu, 10 Jan 2008 10:16:34 -0600

Many enterprises have taken a segmented approach to Business Continuity and Availability, adding point technology and reactive services to address disaster recovery. This approach can be very complex, time-consuming and costly. The task becomes much easier when a single vendor takes responsibility for architecting, implementing, testing and supporting the solution.

There is an increase in the number of companies and organizations requiring 24 x 365 days of IT uptime. In fact, ESG research indicates that 36% of enterprises indicate they will incur significant revenue loss or other adverse business impact if they have even an hour or less of downtime on their mission-critical applications. Almost 15% indicate they cannot tolerate any downtime.1 In the past, this type of business demand was only consigned to a relatively small group. However, many more organizations of all sizes, in all industries and located across the globe, now require applications to be running and data to be always available. The needs of these organizations go far beyond simply recovery, requiring an environment that maintains business continuity during and immediately after a disaster. To make it more interesting, the number and types of applications that require this level of protection is very diverse.

Cyber Attacks Can Impact Your Disaster Plan

webmaster — Fri, 14 Dec 2007 10:48:00 -0600

A cyber attack reported last week by one of the federal government's nuclear weapons laboratories may have originated in China, according to a confidential memorandum distributed Wednesday to public and private security officials by the Department of Homeland Security.

Security researchers said the memorandum, which was obtained by The New York Times from an executive at a private company, included a list

of Web and Internet addresses that were linked to locations in China. However, they noted that such links did not prove that the Chinese government or Chinese citizens were involved in the attacks. In the past, intruders have compromised computers in China and then used them to disguise their true location.

Officials at the lab, Oak Ridge National Laboratory in Tennessee, said the attacks did not compromise classified information, though they acknowledged that they were still working to understand the full extent of the intrusion.

- more info

Security requirements demand that disk files be erased not just deleted

webmaster — Wed, 05 Dec 2007 14:33:06 -0600

When you delete a file from your hard disk, it may seem as if it is gone forever In truth, however, this is not the case. You must wipe it clear "serveral" times or someone can find traces of the data that was there orginally.

The reason why file deletion is not as thorough as it can be is a simple one; resource management. Actually overwriting every bit of every file that is to be deleted will use more resources than would be practical, for everyday use. And in fact, this simple file deletion is usually sufficient for the basic users needs.

The seemingly permanent process of file deletion actually leaves the file data still on the hard disk. When a file is deleted, it is simply marked deleted, and the space that it occupies on the disk is accordingly marked ready for use. Hence, it may be overwritten when more disk space is required, but this is by no means certain, unless the entire hard disk is filled with data.

Now, the actual data that make up the file is still on the hard disk, even after deletion. This makes it available for recovery, usually done using specially designed data recovery programs. MSDOS, in fact, has a built-in UNDELETE command which may recover recently deleted files.

However, secur

ity considerations might necessitate the complete erasure of a given hard disk or collection of hard disks. When reassigning hard disks, for instance, or switching computers around, confidential data might need to be deleted. To lessen the possibility that this data is recovered, a hard disk wipe may be performed.

When a hard disk wipe is performed, the entire area of the hard disk is actually overwritten with random data. This means that the data that used to be on the hard disk becomes much harder (practically impossible) to recover after such a process. Almost no traces of the previous data that used to be on the disk is left, making a hard disk wipe a secure improvement upon ordinary file deletion.

The metadata or information on the data that used to be on the hard disk is also wiped clean, since the entire space of the hard disk is overwritten. The randomness of this data used to overwrite depends on the algorithm used to generate it. Some hard disk wipe programs give users the choice to select the algorithm they want the program to use. However this is not as necessary for hard disk wipe programs as it is for file shredder programs, which wipe individual files. This is because when it is the entire hard disk that is wiped, the degree of randomness of the overwriting data is not anymore as important.

Performing a hard disk wipe is often as easy as clicking a few buttons in a specially designed hard disk wipe program. Some programs are set to run automatically when a CD containing the program is placed into the computer containing the hard disk to be wiped. This makes it easier to perform batch wipes on many computers at once, and makes the hard disk wipe a feasible security solution for multiple hard disks.