>> Disaster recovery plans.
The learning objectives for this lesson are to
differentiate the types of alternate sites,
to describe the role of the Cloud in disaster recovery,
and to explore incident response.
Let's get started. Alternate operating facilities.
Sometimes, it's necessary that we have
to operate from a secondary location rather
than our main location and this
might be because of a natural disaster such as
a tornado has knocked our facility offline or it may be
that we have other issues
such as Internet outages or power outages,
that type of thing at our facility and we need to have
a plan for a secondary facility to take over.
But because this is not
a quick process for this to be successful,
it requires a lot of pre-planning to
ensure that everything is in place when the time comes,
when we need that site.
Site selection. We first start off with a cold site.
This requires the least maintenance for us,
but it requires a large amount of prep time.
The site will only have power and nothing else.
The location is usually just reserved for us,
but has no prep and nothing
has been done to it to make it ready for us.
A warm site is a scaled-down version of our main site.
Systems are mostly configured to be ready for use,
but some reconfiguration would be necessary.
We would need to get the most recent backups to restore
and maybe do a little bit more configuration
to get everything up and running.
In this case, we've got
a lot more expense involved because we have systems
in place and they're being kept fairly current
and we have Internet access and utilities are there,
so there's a lot more costs with that,
but a lot less prep time than say with a cold site.
A hot site is one that can be activated within minutes.
It has very little prep time,
but it's also the most expensive to
maintain because we're keeping it very
current so that we can just flip the switch
and roll over to that site should it be necessary.
We also have mobile sites which
are somewhere between a warm and a cold site.
It contains everything that we would need to configure,
but it can be delivered
very quickly by a mobile site operator and then we would
have to go in there and make sure that it's set up for
our current requirements and
then shift over operations to that.
Cloud and disaster recovery.
The Cloud allows for running many apps
that have been traditionally ran locally on a network.
Using the Cloud resources,
this allows us for a hybrid or an organization may
use it in a traditional way
until their main side is backup.
But they may also have to
transfer more of their infrastructure
to the Cloud to help ensure
recovery is faster for other areas.
The Cloud allows us to very quickly shift
services over and then
while we're repairing our facility,
we can shift it back.
But depending on what is
required for a given organization,
we may have to shift a lot more of that
to the Cloud and that does take time.
Disaster recovery in the Cloud is often referred to as
DRaaS or disaster recovery as a service.
Incident response roles. NIST 800-61,
computer security incident response handling defines
the following roles for incident response; management,
information assurance, IT support, legal department,
public affairs and media relations,
human resources, business continuity planning,
and physical security and facilities management.
All of these play a role
in shifting from one facility to another.
If something were to happen,
we would consider this an incident
and we have to build to respond to that.
We need to know ahead of time
who we're going to need to deal with and who is
going to have to have a say or a part
to play in this incident response and to
let us know that these
are the roles that need to be performed by each of these.
For example, when I said all
this needs to be decided ahead of time
because you don't want to have to go
through and try to figure out who you
need to go grab when your building
is no longer available.
Management obviously, has a big role to play in
this and information assurance
and IT support do, as well.
But because of the legal concerns, especially,
when it comes to compliance frameworks
and privacy of data,
that type of thing,
we want to involve the legal department.
If it involves something that's
a fairly large incident that's going to become public,
then our public affairs and
media relations would need to be involved.
Human resources would need to be involved along
with our business continuity planning team.
Then because we're shifting
our resources over from one facility to another,
then we might not even own,
we obviously need to involve physical security as well as
the facilities management team there'll be
managing that new location.
Then we have our after-action reports.
After the incident has occurred
and you have recovered everything from it,
you've shifted back to your primary location
and you're no longer running off
of your secondary location,
now, we need to document everything.
We need to make sure that we find the areas that we
didn't do a good job on and
document ways to improve those.
This is a critical part of our disaster
in our backup and disaster recovery process.
It allows us to measure the overall performance
of the process as well as each member of the team.
We document what went wrong and what we did well,
and then areas that we can improve.
This will help to ensure that this process
is always improving and it will be
better the next time we need it. Let's summarize.
We went over the different types
of alternate operating facilities.
We discussed the Cloud's role in disaster recovery.
We went over the incident response roles and
then also the importance of our after-action reports.
Let's do some example questions. Question 1.
This type of alternate site requires the most work,
but these the cheapest to maintain. Cold site.
Because it basically has only power,
it is very inexpensive for us to maintain.
Since nothing else is there,
it doesn't even have furniture
and may not even have walls yet,
it's going to take a lot to get it up
and running. Question 2.
This type of alternate site can
be up and running within minutes,
but it is very complicated and expensive. Hot site.
Because everything is already in place
and all the technology is there even our data is there,
it would just take minutes to
flip over from one site to this one.
This is very expensive to maintain and again,
this increases the complexity of
our overall enterprise environment. Question 3.
True or false. The Cloud has replaced
all other forms of disaster recovery
since everything is always available.
False. While Cloud migration is accelerating,
many sites use the Cloud
to help them restore their local systems,
and then once they're up and running,
they shift operations back to their local network.
Question 4. Which of the following
are not needed in incident response?
The HR department, the legal department,
the accounting department or the facilities management.
Three, the accounting department.
Hope this lesson was helpful for
you, and I'll see you in the next one.