Disaster Recovery and Unstable Furniture

Size: px

Start display at page:

Download "Disaster Recovery and Unstable Furniture"

Chad Sharp
8 years ago
Views:

1 Disaster Recovery and Unstable Furniture Presented by Michael Richmond, CISSP #SuperConf15

2 #SuperConf15

3 Essentials of Information Technology Where we came from Primarily single source Largely asynchronous Where we are going Multiple sources, multiple devices, multiple applications Non real-time and real time, interactive Inside my organization Static and pre-defined networks You find information, people Inside the firewall, walled off Communities Dispersed teams, outside my organization Dynamic teams Right time, right people, right resource Inclusive, selective, fluid

organization Static and pre-defined networks You find information, people Inside the firewall, walled off Communities

4 Increasing Dependence Directly Communication ( , IM, VoIP) Commerce (business, banking, e-commerce, etc.) Control systems (public utilities, etc.) Information and entertainment Sensitive data stored on the Internet Indirectly Government Agencies, Educational Institutions and even businesses have permanently replaced physical/manual processes with Internet-based processes

) Information and entertainment Sensitive data stored on the Internet Indirectly Government

5 According to the SBA, small businesses: Represent 99.7% of all employer firms Employ about half of all private sector employees Have generated 65% of net new jobs over the past 17 years Made up 97.5% of all identified exporters. #SuperConf15

sector employees Have generated 65% of net new jobs over the

6 Scope of Impact Up to 40% of businesses affected by a natural or human-caused disaster NEVER reopen. Larger businesses are asking their vendors about preparedness. Insurance is only a partial solution. Businesses need to reach out to customers and other stakeholders quickly. #SuperConf15

Larger businesses are asking their vendors about preparedness.

7 Presidential Declarations #SuperConf15

8 Disasters are defined in terms of the business If it harms critical business processes, it may be a disaster Time-based definition how long can the business stand the pain? Probability of occurrence

disaster Time-based definition how long can the

9 IT Events That Impact Information Availability Events that require a data center move: Fewer than 1% of occurrences Natural disasters Business mergers, acquisitions, or relocations Unscheduled events/failures: 15% Server, application, network, or storage failures Processing or operator errors Scheduled events/competing workloads: 85% Maintenance, migrations, backups/restores, batch jobs, new applications or upgrades Data warehouse extracts, builds, and loads

application, network, or storage failures Processing or operator errors Scheduled events/competing workloads: 85%

10 Four Phases of Emergency Management Comprehensive emergency management addresses all hazards Four phases Mitigation Preparedness Response Recovery

11 Engineering Firm Example #1 #SuperConf15

12 Business Continuity vs. Disaster Recovery Business Continuity (BC): Considers the research, production or services and business functioning of the organization as a whole. Includes risk assessment, and plans for functional units and business processes. Disaster Recovery (DR): Activities to enable recovery to an acceptable condition after a disaster. DR requires guidance from BC to direct priorities and set scope.

functioning of the organization as a whole.

13 Business Continuity vs. Disaster Recovery

14 Business Continuity Addresses: Continuation of critical business processes when a disaster destroys capabilities Preparation, testing and maintenance of specific actions to recover normal processing and procedures (the BCP)

capabilities Preparation, testing and maintenance of

15 BCP-the 3 Legged Chair Availability the main focus Confidentiality Integrity

16 Business Continuity Considerations What are your company s most critical processes and data needs? How much data can you afford to lose? How quickly do you need to restore your critical processes? How vulnerable are your operations to disasters? Answer these questions with the right solution to mitigate these risks

How quickly do you need to restore your critical processes?

17 Furniture Store Example #2 #SuperConf15

18 The five BCP phases Project Management Business Impact Analysis Recovery Strategies Plan design & Development Testing, maintenance, training

19 Project Management & Kickoff Establish need (risk analysis) Get management support Establish team (functional, technical, BCC Business Continuity Coordinator) Create work plan (scope, goals, methods, timeline) Initial report to management Obtain management approval to proceed

Business Continuity Coordinator) Create work plan (scope, goals,

20 Business Impact Analysis Goal: obtain formal agreement with senior management on the MTD for each time-critical business resource Quantifies loss due to business outage (financial, extra cost of recovery, reputation) Does not estimate the probability of kinds of incidents, only quantifies the consequences MTD- Maximum Tolerable Downtime, or MAO- Maximum Allowable Outage

extra cost of recovery, reputation) Does not estimate the probability of kinds of incidents,

21 BIA Phases Information Gathering Analyze Information Identify time-critical business functions Assign and rank by MAO s Report and gain Management Approval #SuperConf15

22 Recovery Strategies Recovery strategies are based on MTD s Business Ops. Predefined Data Recovery Facilities /Supplies Management approved Communication Users

23 Example #3 Local Community Bank #SuperConf15

24 Protecting Information Is a Business Decision Different technical strategies Different costs and benefits How to choose? Careful cost-benefit analysis Driven by business requirements Recovery point objective (RPO): How recent is the point in time for your recovery? Recovery time objective (RTO): How fast can you restart a failed application or process?

25 Protecting Information Is a Business Decision RPO+RTO= Acceptable Business Risk RPO RTO TIME DAYS HRS MIN SEC SEC MIN HRS DAYS EVENT

26 Business Continuity and Disaster Recovery Decision Drivers Business Considerations Cost Functionality, Availability Recovery Time Objectives Recovery Point Objectives Technical Considerations Consistency and Recovery Capacity Bandwidth Performance PRIMARY DECISION DRIVERS

27 Resources SBA FEMA NFPA 1600 ISO Local/State Governmental Agencies Insurance Providers #SuperConf15

28 Key Takeaways Tone from the Top BC is Temporal Be Contextual Think Globally

29 Thank You Questions? #SuperConf15

DISASTER RECOVERY BUSINESS CONTINUITY DISASTER AVOIDANCE STRATEGIES

DISASTER RECOVERY BUSINESS CONTINUITY DISASTER AVOIDANCE STRATEGIES Dejan Živanović EMC Technology Solutions Group SEE Presales Manager Dejan.Zivanovic@emc.com 1 The Business Maturity Model V Enabled Web