Problem: You need a plan for responding to major and minor disasters to let your company restore IT and business operations as quickly as possible.
1. Review Your Backup Strategy
- Full daily backups of all essential servers and data is recommended.
- Incremental and differential backups may not be efficient during major disasters, due to search times and hassle
- If running Microsoft Exchange or SQL servers, consider making hourly backups of transaction logs for more recent restores
- Store at least one tape off site weekly, and store on-site tapes in a data-approved fireproof safe
- Have a compatible backup tape drive
2. Make Lots of Lists
- Document Business Locations
- Addresses, phone numbers, fax numbers, building management contact information
- Include a map to the location and surrounding geographic area.
- Equipment Lists
- Compile an inventory listing of all network components at each business location. Include: model, manufacturer, description, serial number, and cost
- Application List
- Make a list of business critical applications running at each location
- Include account numbers and any contract agreements
- Include technical support contact information for major programs
- Essential Vendor List
- List of essential vendors, those who are necessary for business operations
- Establish lines of credit with vendors incase bank funds are no longer readily available after disasters
- Critical Customer List
- Compile a list of customers for whom your company provides business critical services
- Designate someone in the company to handle notifying these customers
- Draw detailed diagrams for all networks in your organization, including LANs and WANs
3. Diagram Your Network
- LAN Diagram: Make a diagram that corresponds to the physical layout of the office, as opposed to a logical one
- Wireless access using Wi-Fi Protected Access security (WPA2) in order to operate in a new location
4. Go Wireless
5. Assign a Disaster Recovery Administrator
- Assign Primary and Secondary disaster recovery administrators.· Ideally, each admin should live close to the office, and have each other’s contact information. Administrators are responsible for declaring the disaster, defining the disaster level, assessing and documenting damages, and coordinating recovery efforts. When a major disaster strikes, expect confusion, panic, and miscommunication. These uncontrollable forces interrupt efforts to keep the company up and running. By minimizing these challenges through planning with employees, efficiency increases. Assign employees into teams that carry out tasks the Disaster Recovery Administrator needs performed.
6. Assemble Teams
Damage Assessment/Notification Team
- Collects information about initial status of damaged area, and communicates this to the appropriate members of staff and management
- Compiles information from all areas of business including: business operations, IT, vendors, and customers
Office Space/Logistics Team
- Assists in locating temporary office space in the event of a Level Four disaster
- Responsible for transporting co-workers and equipment to the temporary site and are authorized to contract with moving companies and laborers as necessary
- Oversees employee issues: staff scheduling, payroll functions, and staff relocation
- Orders replacement equipment and restores computer systems.
- Re-establishes connection to telephone service and internet/VPN connections
Public Relations TeamSafety and Security Team
- Ensures safety of all employees during the recovery process.
- Decides who will and who will not have access to any areas in the affected location.
Office Supply Team
7. Create a Disaster Recovery Website
- A website where employees, vendors, and customers can obtain up-to-date information about the company after a disaster could be vital.· The website should be mirrored and co-hosted at two geographically separate business locations.
- On the website, the disaster recovery team should post damage assessments for business locations, each location’s operational status, and when and where employees should report for work.
- The site should allow for timestamped-messages to be posted by disaster recovery administrators. SSL certificates should be assigned to the website’s non-public pages.
8. Test Your Recovery Plan
- Most IT professionals face level one or level two disasters regularly, and can quickly respond to such events. Level three and four disasters require a bit more effort. To respond to these more serious disasters, your disaster plan should be carefully organized.· Plan to assign whatever resources you do have control over in such situations. Test the plan after revisions, and discuss what worked and what didn’t.
9. Develop a Hacking Recovery Plan
- Hacks attacks fall under the scope of disaster recovery plans.
- Disconnect external lines. If you suspect that a hacker has compromised your network, disconnect any external WAN lines coming into the network. If the attack came from the Internet, taking down external lines will make it harder for the hacker to further compromise any machines and with luck prevent the hacker from compromising remote systems.
- Perform a wireless sweep. Wireless networking makes it relatively simple for a hacker to set up a rogue Access Point (AP) and perform hacks from the parking lot. You can use a wireless sniffer perform a wireless sweep and locate APs in your immediate area.
10. Make the DRP a Living Document
- · Review your disaster recovery plans at least once a year. If your company network changes frequently, you should probably create a semi-annual review. It’s best to know that an out-of-date disaster plan is almost as useless as having none.
- WAN Diagram: Include all WAN locations and include IP addresses, model, serial numbers, and firmware revision of firewalls