Principles of Incident Response and Disaster Recovery

1. Principles of Incident Response and Disaster Recovery Chapter 8 Disaster Recovery: Operation and Maintenance

2. Objectives • Understand the key challenges an organization faces when engaged in disaster recovery operations • Know what actions organizations take to prepare for the activation of the DR plan • Recognize what critical elements compose the response phase of the DR plan • Know what occurs in the recovery phase of the DR plan Principles of Incident Response and Disaster Recovery

3. Objectives (continued) • Understand how an organization uses the resumption phase of the DR plan • Know how an organization resumes normal operations using the restoration phase of the DR plan Principles of Incident Response and Disaster Recovery

4. Introduction • An organization should operate on the premise that it is only a matter of time until a disaster strikes • Proper response to a disaster requires meticulous preparation and ongoing diligence • In the event of a total loss, an organization must be prepared to promptly reestablish operations at a new permanent location Principles of Incident Response and Disaster Recovery

5. Facing Key Challenges • Disasters are not confined to the IT department or limited to the assets of the organization • Disasters may also affect the community and employees personally, as well as vendors and suppliers • In a major or widespread disaster, there may be challenges associated with local emergency services, service providers, and other-non business issues Principles of Incident Response and Disaster Recovery

6. Facing Key Challenges (continued) • Areas possibly affected in a major disaster: • Basic emergency and transportation services • Food and survival supplies • Water supplies and sanitation • Electrical power • Products and services delivered by vendors and suppliers • Telecommunications services (land and cellular) • Transportation services (freeways, highways, and local streets) Principles of Incident Response and Disaster Recovery

7. Facing Key Challenges (continued) • Major disaster can result in: • Declaration of state of emergency • Imposition of martial law • Restrictions on movement or quarantines • DR plan typically involves 5 phases: • Preparation • Response • Recovery • Resumption • Restoration Principles of Incident Response and Disaster Recovery

8. Preparation: Training the DR Team and the Users • In DR planning, there is no prevention phase • Take steps during preparation to minimize losses • Preparation: making an organization ready for possible contingencies that escalate to disaster • Preparation phase is continuous, but other phases are activated by triggers such as: • Management notification • Employee notification • Emergency management notification • Local emergency services • Media outlets Principles of Incident Response and Disaster Recovery

9. Disaster Recovery Planning as Preparation • 3 primary objectives of the DR plan: • Eliminate or reduce potential for injuries or loss of life, damage to facilities, and loss of assets and records to minimize disruption and financial loss and reduce or limit liability exposure • Stabilize the effects of the disaster to allow recovery efforts to begin • Implement DR procedures Principles of Incident Response and Disaster Recovery

10. Disaster Recovery Planning as Preparation (continued) • Recovery efforts must be prioritized as follows: • Employees • Customers • Facilities • Assets • Records • CP team creates scenario development and impact analysis, and categorizes the level of threat for each potential disaster Principles of Incident Response and Disaster Recovery

11. Disaster Recovery Planning as Preparation (continued) • Key features of the DR plan: • Clear delegation of roles and responsibilities • Execution of the alert roster and notification of key personnel • Use of employee check-in systems • Clear establishment and communication of business resumption priorities • Complete and timely documentation of the disaster • Preparations for alternative implementations Principles of Incident Response and Disaster Recovery

12. Disaster Recovery Planning as Preparation (continued) • All employees should have 2 types of emergency information in possession at all times: • Personal emergency information (who to notify) • Instructions on what to do in the event of an emergency (snapshot of the DR plan) • Emergency info should include contact number or hotline for the organization, emergency services numbers, evacuation and assembly locations, disaster recovery coordinator, etc. • Crisis management: focused steps that deal with safety of people who are involved in the disaster Principles of Incident Response and Disaster Recovery

13. DR Training and Awareness • DR training focuses on the roles each individual is expected to execute during an actual disaster • For most employees, training is limited to awareness • General job function training is key to being prepared for disaster recovery actions • Cross-training should also be considered, both vertically and horizontally, to deal with personnel shortages • Training should include operating in degraded mode Principles of Incident Response and Disaster Recovery

14. DR Training and Awareness (continued) • Disaster management team (command and control group) training is primarily about communication • Communications team training involves preparing information notices, news releases, and internal memorandums and directives • Hardware recovery team training may include training to rebuild damaged systems by scavenging from other damaged systems Principles of Incident Response and Disaster Recovery

15. DR Training and Awareness (continued) Principles of Incident Response and Disaster Recovery

16. DR Training and Awareness (continued) • Systems recovery team training is mostly the same as their normal operations training • Network recovery team training may include wireless network installation as a quick recovery mechanism, walkie-talkie deployment, and other connectivity mechanisms • Storage recovery team training may include rebuilding damaged storage systems and recovering data from offsite Principles of Incident Response and Disaster Recovery

17. DR Training and Awareness (continued) Principles of Incident Response and Disaster Recovery

18. DR Training and Awareness (continued) • Applications recovery team training primarily consists of skills used in normal operations • Data management team training focuses on rapid data restoration and recovery from backup • Vendor contact team training focuses on methods of obtaining resources as quickly as possible • Damage assessment and salvage team training primarily consists of hardware repair skills that enable team members to determine if items are repairable or not Principles of Incident Response and Disaster Recovery

19. DR Training and Awareness (continued) Principles of Incident Response and Disaster Recovery

20. DR Training and Awareness (continued) • Business interface team training includes communication skills and mechanisms for assisting with routine needs • Logistics team training includes training in purchasing and procurement and providing rest and comfort for other workers Principles of Incident Response and Disaster Recovery

21. DR Plan Testing and Rehearsal • Testing of the plan and the training and rehearsal of the plan can overlap • Testing can involve several levels of assessment: • Employee self-assessments • Peer evaluations • Formally appointed internal assessors • External certification or accreditation groups • Classroom training should come first before actual rehearsals Principles of Incident Response and Disaster Recovery

22. DR Plan Testing and Rehearsal (continued) • Testing strategies include: • DR plan desk check: individual review of plan • DR plan structured walk-through: group exercise • DR plan simulation: each individual works independently • DR plan parallel testing: act as if the disaster had occurred but do not interfere with normal operations • DR plan full interruption: act as if disaster had occurred, and perform all steps including data recovery • DR plan war gaming: few tools available for this in the private sector Principles of Incident Response and Disaster Recovery

23. Rehearsal and Testing of the Alert Roster • Alert roster must be tested more often than other plan components due to employee turnover • Quarterly testing is recommended • Alert message contains just enough information to allow employees to determine which part of the DR plan to implement • Auxiliary phone alert and reporting system: automated system for activating the alert roster • You are never completely ready for a disaster • Key skills to retain from rehearsals are flexibility, decisive decision making, and professionalism Principles of Incident Response and Disaster Recovery

24. Disaster Response Phase • Response phase: the phase associated with implementing the reaction to a disaster • Response phase focuses on controlling or stabilizing the situation for the purposes of: • Protecting human life and well-being • Limiting or containing damage to facilities and equipment • Managing communications with employees and other stakeholders Principles of Incident Response and Disaster Recovery

25. Recovery Phase • Recovery phase: • Initiates the recovery of the most time-critical business functions • Focuses on getting up and running as quickly as possible, even in degraded mode; less critical operations must wait for the resumption phase • Primary goals of the recovery phase: • Recover critical business functions • Coordinate recovery efforts • Acquire resources to replace damaged or destroyed equipment or materials • Evaluate whether to implement the business continuity plan Principles of Incident Response and Disaster Recovery

26. Resumption Phase • Resumption phase: focuses on non-critical functions • BIA should guide in the prioritization of critical and secondary functions • Goals of the resumption phase: • Initiate implementation of secondary functions • Finalize implementation of primary functions • Identify additional needed resources • Continue planning for restoration Principles of Incident Response and Disaster Recovery

27. Restoration Phase • Restoration phase: the final phase of disaster recovery • Primary goals of restoration phase: • Repair all damage to primary site or select or build a replacement facility • Replace damaged or destroyed contents of primary site including supplies, equipment, and material • Coordinate relocation from temporary offices to primary site or suitable new replacement facility • Restore normal operations at primary site, beginning with critical functions, then secondary operations • Stand down the DR team and conduct the after-action review Principles of Incident Response and Disaster Recovery

28. Repair or Replacement • Two possibilities in restoration phase: • Reestablish operations at primary site • Establish operations at a new permanent site • Reestablish operations at primary site: • Must be able to rebuild damaged facilities • May need to relocate administrative functions to provide space to the operational functions while rebuilding is underway • New permanent site options: • New location • Complete rebuild on site of destroyed facilities Principles of Incident Response and Disaster Recovery

29. Restoration of the Primary Site • After physical facilities are rebuilt, the contents must be replaced, including: • Office furniture, PCs, photocopies, filing systems, office supplies, etc. • Must assess what will be covered by insurance and service contracts Principles of Incident Response and Disaster Recovery

30. Relocation from Temporary Offices • Transition back to the primary site must be carefully coordinated to minimize additional disruptions to business functions • If data management functions must move, may want to use a movement coordinator to plan the relocation of personnel, equipment, materials, and data back to the primary site Principles of Incident Response and Disaster Recovery

31. Resumption at the Primary Site • Must reestablish all normal operations, including tertiary operations that may have been suspended due to relocation, such as: • Managing employee benefit packages • Employee training and awareness programs • Organizational planning retreats and meetings • Routine progress meetings and reports • Long-term planning activities • Research and development activities Principles of Incident Response and Disaster Recovery

32. Standing Down and the After-Action Review • Standing down: the deactivation of the disaster recovery team, releasing individuals back to normal duties • After-action review provides a method for management to obtain input and feedback from each group represented in the team • AAR log serves as legal and planning record and tool for future training • Official report should include AAR and reports from individual teams Principles of Incident Response and Disaster Recovery

33. Summary • An organization should operate on the premise that it is only a matter of time until a disaster strikes • 5 phases in the DR plan: preparation, response, recovery, resumption, restoration • Goals of DR and business resumption planning: eliminate or reduce potential for injuries or loss of life, stabilize the effects of the disaster, implement the DR plan based on type and impact of disaster • Recovery phase attempts to recover the most critical business functions immediately Principles of Incident Response and Disaster Recovery

34. Summary (continued) • Resumption focuses on the remaining unrestored functions • Restoration seeks to: • Repair all damage to primary site or arrange a replacement facility • Replace all damaged or destroyed contents • Coordinate relocation from temporary back to primary site • Restore normal operations at primary site • Stand down the DR teams and conduct the AAR Principles of Incident Response and Disaster Recovery