Contingency Management in IT

Presentation Outline Components of contingency planning Insurance and backups Actual IT contingencies - Y2K problems - major viruses/worms

Three Main Components of Contingency Planning Incident Response Disaster Recovery Business Continuity

Incident Response (IR) a detailed set of instructions used to plan and anticipate for an event that could harm assets only covers minimal disasters act on the incident - report a possible incident - classify the incident - contain - document

Disaster Recovery (DR) instructions to plan for major incidents (disasters) could be natural (fire, flood, wind, etc..) or manmade (viruses, system misuse) act on the disaster - notify all employees that may be infected - set roles and responsibilities to key personnel - setup alternative business processes (backups) - document all steps in detail bring business back up and running (rebuild structures, implement backups from offsite locations, etc…)

Business Continuity (BC) steps a business must take in order to get it back up and running properly not typically monitored by the IT department setup hot, warm, or cold sites for temporary business functions usually only works directly with the DR team since minor incidents don’t require the business to be reconstructed or setup again

Insurance and Backups be sure your company has an insurance policy to cover lost assets (both informational and physical) backup all information to onsite and offsite locations in case of a major disaster base you insurance policies on location…avoid bankruptcy

Planning for Contingencies: Y2K one of the biggest scares in the information world, specifically banking, electrical and computing, was Y2K scare came about because of date strings being processed in different ways from and the changing of 2 digit dates to 4 digit dates almost all major companies that used computer systems had to develop a contingency plan for Y2K although event never happened, most businesses had a plan in effect and were ready to react

Planning for Contingencies: Worms MyDoom - replicated through attachments - disables antivirus systems from removing it NetSky - passed through attachments - made computer “beep” at random times Klez - passed through as fake attachments from Microsoft Blaster - replicated throughout networks - forced computer to reboot because of Remote Procedure Call errors

Conclusion without planning for contingencies a business would never survive following the main components of contingency planning is key for successful restarts if a disaster does occur be sure to have insurance and backup policies in place

Whitman, M., & Mattord, H. (2004). Management of Information Security. Canada: Thomson Learning, Inc. pp Morrison, Malcolm. (2000). Beyond Y2K: It’s Not Over Till It’s Over. Nursing Homes: Long Term Care Management, Vol. 49, Issue 1. Marino, Gene. (2003). Contingency Planning Essentials. Industrial Engineer: IE, Vol. 35, Issue 7. Disaster. Merriam-Webster’s Online Dictionary. (2006).. References