Business Continuity and Disaster Recovery Part 2 and Wrap-Up

00:00

So after we've initiated the project, we've done our business impact analysis, identified recovery strategies and written the plan.

00:08

The next thing we have to do is test it.

00:11

What we're checking here is accuracy and completeness of the plan itself to figure out if it's practical, if it will work. And if we thought of everything.

00:19

When we talk about testing, we're evaluating the plan.

00:22

When you conduct exercises and drills, you're focusing on employee response. But here we're looking at the plant.

00:29

We need to maintain this plan by revisiting and testing it at least once per year or in the event of a major change.

00:36

We want to keep up the plan to date, and we're capable of managing a disaster.

00:41

Senior management must sign off on the results of the test because they are ultimately responsible for ensuring the safety and well being of our staff as well as protecting the assets of our organization.

00:52

There are different types of test, starting with the checklist test very basic. This is paper based. We create a checklist and pass it out to department managers and ask if we thought of everything.

01:03

A check, yes or let us know what we forgot.

01:06

We don't get a lot of information from a checklist test, but it's a place to start.

01:11

The next step is to bring the managers in with the checklist for their discussion.

01:15

This gives us a better understanding of interdependencies and how things work as a part of the big plan.

01:21

It's still a paper based test,

01:23

but this is called a tabletop test.

01:26

It can also be called a structured walkthrough.

01:27

Where we actually do get up and go through the motions is our simulation test.

01:33

In a simulation test, we go through things like, Can we get to the H Vac system? Do we have keys to the generator? Are the doors unlocked as they should be for evacuation?

01:42

We're moving through the phases of the plan to get a better idea of whether it will work.

01:48

We then may go to a parallel plan.

01:49

Not all organizations go through this test.

01:53

We'll set aside a certain amount of processing to take place at the off site facility.

01:57

The majority will happen at our primary facility. What? We're doing a live test in a parallel.

02:02

In a full interruption test, we shut down our main facility and bring up operations at the off site facility.

02:08

This is by far the most risky test.

02:10

Often we perform these tests in sequence, starting with the checklist to tabletop to simulation.

02:16

We may or may not go to parallel and full interruption test because they are risky.

02:22

Once the plan has been tested, it's our job to maintain it

02:24

again. You come back once a year or in the event of a major change, to keep it up to date

02:32

our key takeaways from this module.

02:35

We talked a lot about network operations, which are the day to day things we have to do to keep up the networking up and running.

02:42

We have to maintain network diagrams and documents that we we know, where the various elements are and how they're configured.

02:49

We discussed policies and best practice everything from changing configuration management to separation of duties.

02:55

Our policies have to be set up to date, and we have to make sure they're providing the administrative control. They're set to provide

03:02

scanning, monitoring and patching.

03:05

This is the maintenance and evaluation of our network.

03:07

Our system is performing as they should

03:10

do. We have rogue systems on the network. Are we operating and save this out of the norm? Are we in compliance with our baselines?

03:17

We should get all this information from monitoring and scanning

03:21

when it comes to patching. We know vendors frequently release updates to their operating systems to their applications.

03:27

We need to make sure we're patched because that will help us secure systems.

03:30

We then moved in default management and discuss redundancy, data backups, clusters and Web servers.

03:38

When we implement fault management, it does have to be all inclusive.

03:42

It doesn't do me any good to back up my data if the server fails. So we want to be thoughtful about what we implement redundancy with.

03:49

Then we moved in discussing what happens when we have disasters.

03:53

These are notable sizeable reductions in operations. We need disaster recovery plan to respond to the immediacy of a disaster.