BA 24 What If??? A Disaster Planning Primer

1. BA 24 What If??? A Disaster Planning Primer Steve Ford Coordinator of Electronic Services Northeastern State University

2. Agenda • Communications disasters • Fundamentals of disaster preparedness • Steps to Building a disaster plan • Items to consider • Methods to provide backup services

3. Communication Disasters Natural Disasters • Earthquake • Floods • High Winds • Hurricane • Thunderstorms • Tornado • Winter Storms

11. Communication Disasters Man-Made Disasters • Fire - Arson & Accidental • Hackers • Human Error • Industrial Sabotage • Disgruntled Employee • Competition • Terrorism • Automobile Accident

22. Fundamentals of Disaster Preparedness • Disaster preparedness is a mindset • Overlook nothing! • Develop your plan assuming a total loss of facilities • The disaster planning team should include • Principal vendors • Key personnel from operational staff • Purchasing • Human Resources • Information Technology • Security

23. Steps to Developing a Disaster Plan • Risk Assessment • Inventory Existing Facilities • Document existing facilities • Identify critical areas of operation • Funding the disaster plan • Document your plan • Develop checklists • Train personnel and test plan

24. Risk assessment – Analysis of the potential for an unwanted event to occur. • 5 Step Risk Assessment Model • Asset Assessment • Threat Assessment • Vulnerability Assessment • Risk Assessment • Identification of Countermeasures

25. Risk Assessment Asset Assessment Identify and focus on the assets of importance to your company. Threat Assessment What are the threats which can adversely affect the operation of my company? Vulnerability Assessment What are the vulnerabilities of my assets to the identified threats? Risk Assessment Process of evaluating the three prior assessments Risk = Consequence x Threat x Vulnerability Identification of Countermeasures Methods to lower the overall risk of an asset to an acceptable level.

26. Steps to Developing a Disaster Plan Inventory Existing Facilities Inventory everything……. • Stations & Consoles • Ancillary Equipment • Location of Backups • Voice circuits • Data circuits • Cards in the PBX

27. PBX Faxes Modems Cable Plant Equipment Rooms Distribution Frames Demarcation points Pay phones Voice Mail system Auxiliary processors UPS equipment MAC Terminals Steps to Developing a DisasterPlan Document existing facilities Draw detailed maps showing the location of ...

28. Risk assessment – Analysis of the potential for an unwanted event to occur. • 5 Step Risk Assessment Model • Asset Assessment • Threat Assessment • Vulnerability Assessment • Risk Assessment • Identification of Countermeasures

29. Asset Assessment Identify and focus on the assets of importance to your company. Threat Assessment What are the threats which can adversely affect the operation of my company? Vulnerability Assessment What are the vulnerabilities of my assets to the identified threats? Risk Assessment Process of evaluating the three prior assessments Risk = Consequence x Threat x Vulnerability Identification of Countermeasures Methods to lower the overall risk of an asset to an acceptable level.

30. Steps to Developing a Disaster Plan Document existing facilities • Also include the following for each component…. • Hardware & software configurations • Whether or not the equipment is on a UPS & it’s duration

31. Steps to Developing a Disaster Plan Identify weakness in current infrastructure Take a hard look at the existing facilities and determine vulnerabilities. Do not forget to check…. • Power supplies • Grounding • Cabling routes • Internal • External • Structural integrity of structures • Fire Suppression • HVAC • Physical Security

32. Steps to Developing a Disaster Plan Identify critical areas of operation Determine mission critical communication requirements for each department within your organization. Prioritize each item by function

33. Steps to Developing a Disaster Plan Funding the disaster plan Budget requests for the equipment necessary to implement the disaster plan should be clear, concise, and describe the benefits and costs for each component.

34. Steps to Developing a Disaster Plan Document your plan Every department within your organization should list the communications they currently use and the minimum communications required to function. Assign personnel responsible for carrying out the plan in the event of a disaster. List steps required to restore critical services identified in the plan

35. Steps to Developing a Disaster Plan Develop checklists A checklists should be included for each piece of equipment which needs to be tested after a disaster. Check with Vendors in advance to determine their response times. Obtain emergency contact list & escalation list from all vendors and carriers with whom you do business with.

36. Steps to Developing a Disaster Plan Train personnel and test plan Personnel responsible for implementing the plan should know the details of the disaster plan intimately. The plan should be tested on a regular basis to make sure it works and personnel are comfortable with it.

37. Items to consider • Who is responsible for backup communications? • What are your existing backup communications? • What are your most critical circuits? • What are your most critical systems? • Do you have backup power? If so how long will it last? • Do you have alternate routing for critical circuits?

38. Items to consider • Does your maintenance contract cover emergency restoration? • What are your backup procedures? Where are they stored? • What about backup personnel? • Are employees cross-trained?

39. Methods to provide backup services • Complete redundant site • Off-line PBX remotely located • Cell phones • Two way radio

40. A fully redundant site is the safest way to ensure uninterrupted communications. Provides a training location for staff Most expensive to implement Requires additional personnel to staff Also susceptible to disasters. Methods to provide backup services Complete redundant site • Pro’s Con’s

41. Methods to provide backup services Off-line PBX remotely located Maintain a backup PBX equipped to perform mission critical communications at any of your locations. Have a dedicated PBX configuration / database for each location which can be restored to the backup PBX then deployed to the disaster area.

42. Methods to provide backup services Cell phones - Many cellular providers maintain a pool of phones which can be utilized by corporate customers in times of disaster. Two way radio - Many companies use two way radios which could be drafted into service during a disaster. Amateur radio can be used for emergency communications. Not to conduct business.

43. Resources Federal Emergency Management Association www.fema.gov National Infrastructure Protection Center www.nipc.gov Federal Bureau of Investigation www.fbi.gov

44. A Beginner’s Guide to Disaster Planning Questions & Answers