-: Disaster Recovery Planning.
Disaster recovery planning is a development of an organized
and in-depth plan for problems
that could affect the access of your data
or your organization's building.
So if you think about the fact that you might have
a cyber attack, or a flood, or a fire,
all of these things might be things that are covered
by your disaster recovery plan.
Now planning should also include
information regarding redundancy,
such as what sites you have, are they warm sites,
cold sites, or hot sites.
How your backups are done
and where they're going to be restored from,
but it shouldn't include any information
that deals with day-to-day operations of your organization.
So I'm not going to have a procedure of how to conduct
the backup, but I might have a policy
on when they should be done.
We should always do full backups on Sunday
and incremental backups every single day thereafter,
those kind of things.
There are a lot of things you need to think about
when creating disaster recovery plans, for example,
what are you going to do in case of a fire.
Now I don't mean about how are you going to put out the fire,
but I mean, how are you going to recover from that fire?
Let's say that it only happened in room,
you had a small fire,
and you were able to put it out with an extinguisher,
but it ruined all of the desks and computers
in that particular office,
let's say that was the accounting office.
How are you going to get those accountants back up
and online with the rest of the organization?
You're going to have to put them in a temporary space,
you're going to have to get new cables and computers
and get all that stuff brought up and recover their data.
That's the kind of thing we're talking about
with disaster recovery,
or what if there's a flood?
If the building gets flooded and you lose access to it,
how are you going to keep your business up and running?
You don't want to be figuring that out when it happens,
you need a plan for that ahead of time
and that's the whole idea of disaster recovery planning
and continuity of operations planning.
What are you going to do if there's a long-term power loss,
for example, maybe you're in an area
where there's hurricanes and the entire power grid
in your area goes out for five days.
Do you have back up generators that can last that long?
Do you have enough gas for 'em,
and if not, how are you going to shift your operations
to a secondary location?
What if you have theft or a malicious cyber attack,
or something else like that?
How are you going to deal with those things?
And I'm not talking about the actual incident response
part of the cyber attack,
but how are you going to get the business back up
and running and keep your data flowing,
and get everything back to the way business used to be?
That's the thing with disaster recovery,
you want to get things back to normal operations
as quickly as possible.
And the last thing is,
what are you going to do if you lose the building?
What if there's an earthquake damage
and the building goes away, again like fire and flood,
you got to find a new place to work.
What if there's riots in the streets or protestors
and you can't physically get into your building that day?
How are your operations going to continue?
All of these are things you need to think about
with disaster recovery and continuity of operations.
Now a good disaster recovery plan
should always be written down,
it shouldn't be here in my head.
Everyone in the organization needs to know
what those policies are.
We should have clearly outlined disaster recovery policies,
procedures, and information.
We should have things like the contact information,
who do I call when there is a disaster?
If we have a flood in the basement, who do I call?
Who's the facilities manager,
who's the disaster recovery company
that we're going to have come in and suck out all that water?
Those type of things are really important.
You also need to have a way to figure out
how are you going to determine the impact of this?
Now what is impact determination?
Well that's when we're going to decide,
okay this was a small fire in the accounting office,
and so the rest of us can still come in and go to work,
and we're going to have to move those accountants
to someplace else.
Maybe they're going to co-locate with the sales people
for the next month while we get their building refurbished.
Next we have to think about the recovery plan,
the recovery plan's going to actually spell out,
what is the order and priority of things
that need to be recovered.
For example, let's say I have a company
that has four different offices spread out across this city,
and all four of them end up getting affected by a fire,
or flood, or a hurricane, or earthquake,
or something like that.
Who is my priority, who do I bring up first,
because not everyone can be number one.
You have to figure out who's first, who's second,
who's third and who's fourth.
Then you need to think about your business continuity plan,
how do I keep operations up and running?
That might be shifting operations to a hot site,
it may be that I'm going to move in
with my partner down the street,
whatever those things are, you need to have a plan for that.
Another thing you need is copies of all of your agreements,
in a hard copy format or digital,
that you can access from anywhere else that you need to.
So in a good example of this, is in one organization I had,
we didn't keep extra routers on hand
because our routers only failed every three years,
so we'd always order them when it came close
to that three year period and bring them in at that point.
But we had an agreement with Cisco
that if our router failed before that,
they would get us a replacement within four hours,
and that was the maintenance agreement we had with them.
By having a copy of that agreement,
if we had a fire or flood, I can execute that and say,
Cisco send me a new device, I need one now
so I can get my network up and running.
Also, you need to think about exercising
these disaster recovery procedures, for example,
I might know what they all are because I wrote 'em,
but does everybody else in the company know?
What if we have a big blizzard,
does everybody know that they don't go to work that day?
What if we're going to have a big fire,
does everybody know what the procedures are to escape
out of the building and save themselves before the data,
and do they know where they're going to operate out of
from there on?
When you do disaster recovery exercises
they can be small or they can be large,
you might go through and actually practice,
what are we going to do if there's a hurricane
and we lose power for three days?
How are we going to continue to operate?
A disaster recovery plan that's on paper
that's never been exercised is never going to be a good thing
when you have to execute it for real.
Always practice them and it's recommended you practice
at least once a year.
The last thing I want to talk about is you need to have
a list of all your critical systems and critical data.
You need to know what's critical so you know what you need
to protect and what you need to bring online first,
so if you have a disaster and you lose all of your servers,
which one is the most important?
Which is the second most important, and so on,
down the list so you know what to bring up first
and what you're going to get recovered before anything else.
(techno music)