Technology Disaster Preparedness

1. Technology Disaster Preparedness Moderator: Douglas Furst Technology Works for Good www.technologyworks.org First Speaker: Johan Hammerstrom Community IT Innovators (C.I.T.I.) www.citidc.com Second Speaker: Richard Feller Hedgehog Hosting www.hedgehoghosting.com

2. Introduction • Technology Disaster Preparedness • Agenda • Before: • What can you do ahead of time? • Johan Hammerstrom, C.I.T.I. • After: • What do you do if something happens to you? • Richard Feller, Hedgehog Hosting • Q&A NTEN: Technology Disaster Preparedness

3. Protect Your Organization,Protect Your Data • Disaster Preparedness is crucial for any business system • It’s not technology…it’s business policy (better yet, a written policy) • Effective policy requires sound business judgment, which means… NTEN: Technology Disaster Preparedness

4. Risk Assessment • What is the Risk? • Determined by… • Likelihood of disaster • Impact of disaster • Identify your biggest threats (Likelihood) • Identify mission critical IT (Impact) NTEN: Technology Disaster Preparedness

5. Create a Disaster Preparedness policy that meets your needs… • What is a Disaster? • Technology Problems • Personnel Problems • Facility Problems • Catastrophic Problems NTEN: Technology Disaster Preparedness

6. Preventing the Disaster • More cost effective than recovery • Adopt a security mindset • “Confidentiality – Integrity – Availability” • Surface area • Defense-in-depth NTEN: Technology Disaster Preparedness

7. Simple things make a big difference… • Password security • Disable former staff accounts • Proper backups including off-site rotation • Antivirus protection • Out of the Box ("OOB") Vulnerabilities • Protection from hackers • Physical security • Don’t forget social engineering • www.citidc.com/security NTEN: Technology Disaster Preparedness

8. What should a disaster recovery plan include Disaster Recovery Committee NTEN: Technology Disaster Preparedness

9. What should a disaster recovery plan include Disaster Recovery Committee • Personnel Continuance • Need of multiple locations • Provisions for needed resource phones/computing • Restoration of functionality to most critical people and projects first • On-site decision-making empowerment NTEN: Technology Disaster Preparedness

10. What should a disaster recovery plan include • Disaster Recovery Committee • Personnel Continuance • Procedural Continuance • Look at possible scenarios • Develop methods to restore critical data and systems • Develop methods for resumptions of key business procedures • Frequent testing and updating of scenarios and methods • Other issues: (food, lodging, power, transportation) NTEN: Technology Disaster Preparedness

11. What should a disaster recovery plan include • Disaster Recovery Committee • Personnel Continuance • Procedural Continuance • Technology Continuance • Computer backup and recovery • Possible outsourced hosting of data systems • Redundancy of data and voice communications links NTEN: Technology Disaster Preparedness

12. What should a disaster recovery plan include • Disaster Recovery Committee • Personnel Continuance • Procedural Continuance • Technology Continuance • Contacts • Who • Leader • Vendor Resources • Managers • How • Include contact numbers • Include times • Include secondary options for contacts NTEN: Technology Disaster Preparedness

13. What should a disaster recovery plan include • Disaster Recovery Committee • Personnel Continuance • Procedural Continuance • Technology Continuance • Contacts • Environment Specifications • Location • Type Quantity • Physical need or intellectual need NTEN: Technology Disaster Preparedness

14. What should a disaster recovery plan include Disaster Recovery Committee Determine when a disaster will be more disastrous. NTEN: Technology Disaster Preparedness

15. Backup and recovery options Cost is one of the biggest factors in any backup/recovery plan Cost and objective should be looked at simultaneously Usually implemented in larger hosting environments Can be used via third party Usually quite costly when implemented in-house Will speak about these more in the outsourcing / hosted portion

16. Online Concerns Environment Bandwidth Security Control Costs Benefits Speedy implementation Low IT overhead Costs Decision time - Online or In-house • Factors to consider: • How much data are we talking about • How much of your IT staff can you spare • Where can you store data In-House • Concerns • Higher IT overhead • Equipment • Location (yours and others) • Costs • Benefits • Total Control • Can implement on your terms • Costs NTEN: Technology Disaster Preparedness

17. In-house Options Online Options NTEN: Technology Disaster Preparedness

18. Some post mortem conclusions • Customer Procedural Problems • Too narrow a focus • No automated means for tracking the location of tapes • No action plan by the customer • Lack of skilled resources from customer side • Inappropriate upper or executive management • No single document that describes the environment • Online data protection procedures were not in place • Summary of lessons learned • Consider working with professional DR consultants • Consider ALL of your software options for protection of servers, applications and tape media, in addition to data NTEN: Technology Disaster Preparedness

19. Outsourcing / Hosted Solutions • Economy of scale • Best in class options • Misconception of costs • Empower IT staff • Focus on core business NTEN: Technology Disaster Preparedness

20. Q&A Johan Hammerstrom Richard Feller NTEN: Technology Disaster Preparedness