Disaster Recovery / Business Continuity

[TheCotMan]

Disaster preparedness and disaster recovery could be a good presentation for Defcon-- it is security related, and theft of information is an issue when decentralization is considered, or remote storage of tape backup is included. Risk of EOL in hardware used to complete backups competes against laws that require certain market sectors to keep records for 5, 10 or 15 years. (What good is a backup tape if there is no hardwre to restore it to present systems?) Yet, there is even MORE that could be covered.

The topic is huge and has a huge security component. Would consider presenting at Defcon? (This is something I'd attend, to see if there are any unconventional shortcuts, or solutions to existing problems.)

[theprez98]

Re: April Meeting

Disaster preparedness and disaster recovery could be a good presentation for Defcon-- it is security related, and theft of information is an issue when decentralization is considered, or remote storage of tape backup is included. Risk of EOL in hardware used to complete backups competes against laws that require certain market sectors to keep records for 5, 10 or 15 years. (What good is a backup tape if there is no hardwre to restore it to present systems?) Yet, there is even MORE that could be covered.

The topic is huge and has a huge security component. Would consider presenting at Defcon? (This is something I'd attend, to see if there are any unconventional shortcuts, or solutions to existing problems.)

I did some graduate work in homeland security/disaster preparedness and agree that it would be a very interesting topic and one that's probably not been discussed enough. If I wouldn't have already submitted a talk I'd consider collaborating on this one.

[Thorn]

Re: April Meeting

Although we all tend to harp on Homeland Security for a number of very legitimate reasons, they have a pretty good website on emergency preparedness located at www.ready.gov.

The Ready America side has the usual checklists and kit lists that you might expect for home preparedness, while the Ready Business side of the site is geared toward SMBs and has a number of PDFs that can be downloaded to help in emergency planning. The business forms cover not only the obvious things like backups, but also the not so obvious things like planning for the number of desks, tables and chairs you might need if you were attempting to set up a business in a temporary location, or consideration of your options if a key supplier goes out of business during an emergency.

We might want to split this off into another thread for more discussion, rather than to completely hijack noid's DC206 announcement.

[noid]

Re: April Meeting

We might want to split this off into another thread for more discussion, rather than to completely hijack noid's DC206 announcement.

Done............

[800XL]

Re: Disaster Recovery / Business Continuity

I agree that disaster readiness is an excellent topic for a Defcon presentation. Many businesses/organizations are very misguided on the subject, focusing too much on the idea of “backup”, instead of the more important “recovery”. Many entities I have worked with are falsely assured that just having tape drive and tapes (such an archaic DR approach) with their data will somehow protect them in case of a disaster. As many of us know, recovery from tape, assuming it is even available on site and not your local Iron Mountain vault, may take hours or even days…In the current business world, when your clients expect access to information/services 24/7, any extended downtime may have catastrophic results. The dynamics have very much changed in the last several years and so did the available DR technologies.

Anyway, I am very much looking forward to someone talking about this at the conference.

[theprez98]

Re: Disaster Recovery / Business Continuity

Along similar lines, consider "man-made" disasters, such as a vengeful, terminated employee (especially IT-related with prior access to critical systems) or a severed business relationship... They could do any manner of things that could create a man-made disaster if proper protocols are not in place or followed.

[converge]

Re: Disaster Recovery / Business Continuity

I have some really good ideas for relatively secure and far more effective data backup and retention than anything that I'm aware exists today... taking a previously noted method I concocted and applying a current popular technology to automate and control it for even the layperson to make full use of.

It is actually something that could be developed .. with the right crew and time. It's something that would make an amazing commercial enterprise product, or a notable opensource tool.

If there are others interested, definitely hit me up in private somewhere .. I'd prefer a decent proof of concept release by con before doing a presentation .. and the downside is, a few months isn't a lot of time, so maybe next year. Or if folks want to drive on a panel, I'd be glad to toss the idea around to the masses, at risk of someone running with it first before select folks claimed ownership of the actual product/project.

[valkyrie]

Re: Disaster Recovery / Business Continuity

*me perks*

Since this is where I really got into the nuts and bolts of information assurance, I would welcome a round table discussion on this topic. I thought of it several years ago for BH/DC, but it didn't seem "sexy" enough. It's one of those day to day things that most cyber cowboys could really care less about. I have another fun thing that I am hoping to pull off for DC, but if anyone wishes to put together a formal or informal discussion regarding this, I would be all over it.

Just as a refresher...I was the DR/BC coordinator for a large Texas county government for 5 years. I think I did a pretty good job when I was there and learned quite a bit about the interesting things that come up when trying to coordinate plans for 27 different departments and 40 different office locales.

Let's play...I think this would be interesting...

Regards,

valkyrie

sapre aude

[Stypica]

Re: Disaster Recovery / Business Continuity

I have another fun thing that I am hoping to pull off for DC, but if anyone wishes to put together a formal or informal discussion regarding this, I would be all over it.

delurking here for a moment...

Since I've been dealing with a customer who's admins haven't been backing squat up, and one of their NFS servers died yesterday... recovery is definitely in my head right now.

This will be my first defcon and I don't really know anybody, but I'd certainly like to be part of an informal discussion on the topic. I've seen a lot of stuff *not* work, but it would be nice to discuss some options that *do*

[TheCotMan]

Re: Disaster Recovery / Business Continuity

Additional items related to this:

* Enabling encryption on tape, for offsite "security" of data while considering the history of implemented encryption in applications over a 5, 10 and 15 year period, for security failure. (Even if we assume we have an application using a cipher that is "100% secure" that doesn't mean the application's implementation is secure. Security holes can mean equivalent "plain-text" storage in remotely stored tapes if physical access to them should be broken.

* Single Point of Failure can lead to disaster when that single point fails:
Does your department, company, group have a single coder that knows everything? Do they have a backup?
Do you have a team of members that support your mission critical applications? Do they fly to presentations on the same jet? Travel in the same car?
Do you have replication of data to off-site locations for mission critical apps for failover like some businesses in the WTC during 9/11?

* Communication
Phone trees in place?
Contact lists?
Backup off-site DNS and MX for failover?
Disaster plan? Is it published? Do people know where to find it? Is is printed in hardcopy and updated?
Established chain of command for recovery? Local security? Police?
How is trust established and identity confirmed when infrastructure is gone?

* MSDS / checmical / information needed by fire department about chemicals stored on site and locations?

* When was the last time your had a fire drill, and established people meet at the locations they are supposed to meet, and the people responsible for clearing the building are available to clear a building?

This topic is so large, there could be multiple presentations with each providing focus on a different section.

It could also be fun to point out where points could be exploited during a disaster. (There are opportunists during times of disaster-- consider looters and people stealing from houses that are not occupied due to evacuation.)

[800XL]

Re: Disaster Recovery / Business Continuity

"Business continuity spending to rise this year
Three out of 10 midsize businesses lack a business continuity plan"

Here is an interesting article on the subject.

[converge]

Re: Disaster Recovery / Business Continuity

At minimum we should organize a poolside chat. I really need to get my idea formalized and presentable so I can share it with folks, possibly pre-seed it amongst folks interested in hopping together on a CFP. Also should try to suck bascule into it, because he rocks much harder than I.

/me continues laundry list

[theprez98]

Re: Disaster Recovery / Business Continuity

I just applied for a DHS/FEMA job "Continuity of Operations Specialist", might be interesting if I get into the interview process.

[valkyrie]

Re: Disaster Recovery / Business Continuity

At minimum we should organize a poolside chat. I really need to get my idea formalized and presentable so I can share it with folks, possibly pre-seed it amongst folks interested in hopping together on a CFP. Also should try to suck bascule into it, because he rocks much harder than I.

/me continues laundry list

That would totally rock. I would really enjoy hearing what others have to say on the topic. Especially about deliniation of core critical processes. That was the most challenging thing I had to deal with -- and it took almost 3 years to get those processes mapped out. Want to hear what others have done to jump start that part of BC process.

theprez98 said:

I just applied for a DHS/FEMA job "Continuity of Operations Specialist", might be interesting if I get into the interview process.

Much good fortune to you. I hope you get in the mix and find the work interesting. Then you can share what you learn with the rest of us. :-)

Regards,

Valkyrie

sapere aude

[converge]

Re: Disaster Recovery / Business Continuity

.. Especially about deliniation of core critical processes. That was the most challenging thing I had to deal with -- and it took almost 3 years to get those processes mapped out.

ok.. talk like that makes you insta-elected to the panel on stage in my books. I'm just a dork with a technical idea .. :p