Disaster Recovery Plans The headquarters of Hill Crest Corporation, a private company with $15.5 million in annual sales, is located in California. Hill Crest provides for its 150 clients an online legal software service that includes data storage and administrative activities for law offices. The company has grown rapidly since its inception 3 years ago, and its data processing department has expanded to accommodate this growth. Because Hill Crest’s president and sales personnel spend a great deal of time out of the office soliciting new clients, the planning of the IT facilities has been left to the data processing professionals. Hill Crest recently moved its headquarters into a remodeled warehouse on the outskirts of the city. While remodeling the warehouse, the architects retained much of the original structure, including the wooden-shingled exterior and exposed wooden beams throughout the interior. The minicomputer distributive processing hardware is situated in a large open area with high ceilings and skylights. The openness makes the data processing area accessible to the rest of the staff and encourages a team approach to problem solving. Before occupying the new facility, city inspectors declared the building safe; that is, it had adequate fire extinguishers, sufficient exits, and so on. In an effort to provide further protection for its large database of client information, Hill Crest instituted a tape backup procedure that automatically backs up the database every Sunday evening, avoiding interruption in the daily operations and procedures. All tapes are then labeled and carefully stored on shelves reserved for this purpose in the data processing department. The departmental operator’s manual has instructions on how to use these tapes to restore the database, should the need arise. A list of home phone numbers of the individuals in the data processing department is available in case of an emergency. Hill Crest has recently increased its liability insurance for data loss from $50,000 to $100,000.

This past Saturday, the Hill Crest headquarters building was completely ruined by fire, and the company must now inform its clients that all of their information has been destroyed. Required: a. Describe the computer security weaknesses present at Hill Crest Corporation that made it possible for a disastrous data loss.

b. List the components that should have been included in the disaster recovery plan at Hill Crest Corporation to ensure computer recovery within 72 hours.

c. What factors, other than those included in the plan itself

d. Give additional examples on how to improve the network security.

e. Give network security recommendations .

Answer: a.) The computer security weaknesses present at Hill Crest Corporation that made it possible for a disastrous data lost to occur include: * Not housing the data-processing facility in a building constructed of fire-retardant materials, and instead using one with exposed wooden beams and a wooden-shingled exterior. * The absence of a sprinkler (halon) system and a fire-suppression system under a raised floor; fire doors. * An on-line system with infrequent (weekly) tape backups. Backups, with checkpoints and restarts, should be performed at least daily. “Grandfather” and “Father” backup files should be retained at a secure off-site storage location. * Data and programs should have been kept in a library separate from the data-processing room, with the library area constructed of fire-retardant materials. * Lack of a written disaster recovery plan with arrangements in place to use an alternate off-site computer center in the event of a disaster or an extended service interruption. There was a phone list of DP personnel, but without assigned responsibilities as to actions to be taken when needed. * Lack of complete systems documentation kept outside the data-processing area.

b.) The components that should have been included in the disaster recovery plan at Hill Crest Corporation to ensure computer recovery within 72 hours include the following: * A written disaster recovery plan should be developed with review and approval by senior management, data-processing management, end-user management, and internal audit. * Backup data and programs should be stored at an off-site location that will quickly accessible in the event of an emergency. * The disaster recovery team should be organized. Select the disaster recovery manager, identify the tasks, segregate into teams, develop an organizational chart for disaster procedures, match personnel to team skills and functions, and assign duties and responsibilities to each member. * The duties and responsibilities of the recovery team include:

* Obtaining use of a previously arranged alternate data-processing facility; activating the backup system and network, and * Retrieving backup data files and programs, restoring programs and data, processing critical applications, and reconstructing data entered into the system subsequent to latest saved backup/ restart point.

c.) Factors, other than those included in the disaster recovery plan itself, that should be considered when formulating the plan include: * Arranging business interruption insurance in addition to liability insurance. * Ensuring that all systems’ and operations’ documentation is kept up to date and is easily accessible for use in case of a disaster. * Performing a risk/ cost analysis to determine the level of expense that may be justified to obtain reasonable, as opposed to certain, assurance that recovery can be accomplished in 72 hours.