INCIDENT RECOVERY

NCAMERON_INCIDENTRECOVERY_12152013

• 6% of all PCs will suffer an episode of data loss in any given year. Given the number of PCs used in US businesses in 1998, that translates to approximately 4.6 million data loss episodes. At a conservative estimate, data loss cost US businesses $11.8 billion in 1998. (The Cost Of Lost Data, David M. Smith)

• Companies that aren't able to resume operations within ten days (of a disaster hit) are not likely to survive. (Strategic Research Institute)

• 60% of companies that lose their data will shut down within 6 months of the disaster.

• 31% of PC users have lost all of their files due to events beyond their control.

• 34% of companies fail to test their tape backups, and of those that do, 77% have found tape back-up failures.

• American business lost more than $7.6 billion as a result of viruses during first six months of 1999. (Research by Computer Economics)

• Companies that aren't able to resume operations within ten days (of a disaster hit) are not likely to survive. (Strategic Research Institute)

LOCATION! LOCATION! LOCATION!

• “In Sandy’s Aftermath, Epic Challenges for Data Centers” (Miller, 2012)• “Temperatures Soar at Data Center Inside 111 8th Avenue” (Miller, 2012)• “Our data center had servers rolling back and forth on earthquake gliders“ - Earthquakes and Data

Centers (Miller, 2012)

THE SOURCES OF LOST DATA

• Hardware or System Malfunctions (44 percent of all data loss)• Human Error (32 percent of all data loss)• Software Corruption (14 percent of all data loss)• Computer Viruses (7 percent of all data loss)• Natural Disasters (3 percent of all data loss)

HARDWARE OR SYSTEM

MALFUNCTION Possible Symptoms

• Error message stating the device is not recognized

• Previously accessible data suddenly gone

• Computer hard drive doesn't function

Examples

• Electrical failure

• Head/media crash

Possible Solutions

• Protect electrical components by using computers in a dry, shaded, dust-free area

• Protect against power surges with an uninterruptible power supply (UPS)

• Incremental/Full data back-up at a remote location

HUMAN ERRORS(HEY, I’M ONLY HUMAN)

Possible Symptoms

• Previously accessible data suddenly gone

• Message similar to "File Not Found“

Examples

• Accidental deletion or drive format

• Trauma caused by drop or fall

Possible Solution

• Never attempt any operation, like installations or repairs, with which you don't have experience

• Avoid moving your computer, especially when it's in operation

SOFTWARE CORRUPTIONPossible Symptoms

• System messages relating to memory errors

• Software application won't load

• Error message stating data is corrupted or inaccessible

Examples

• Corruption caused by daily activity

• Failed backups

Preventative Routines

• Back up data regularly

• Use diagnostic utilities with caution

COMPUTER VIRUSES

(HACKERS)

Possible Symptoms

• Blank screen

• Strange and unpredictable behavior

Examples

• Boot sector viruses

• File infecting viruses

• Polymorphic viruses

Preventative Routines

• Firewalls

• Obtain software from reputable sources with digital certificates

NATURAL DISASTERS(LOCATION! LOCATION! LOCATION!)

Possible Symptoms

• Shaking Earth

• Waters rising

• Normally heavy items tossed about in air

• Melting

Examples

• Tornadoes

• Earthquake

• Fire

• Flood

• Hurricane

• Extraterrestrial Alien takeover

Absolute Measures

• Store tested backups in an off-site location

• Install a UPS

• Generator

KNOWING IS HALF THE BATTLE

KNOW THE THREATS

• Understand the how the causes can affect your business

• Lost data is lost money

BE READY • Have a plan in place for

each cause

• How much money will we lose if a incident where to occur?

THE PLAN • Inventory all hardware

• Inventory current software on the workstations

• Set a password timeframe for when employees must change their passwords

• Make sure only authorized people have access to the building

• For remote users use NAP Remediation

• User Account Control (UAC) in place

• Firewalls

• Configure user rights to job functions and specific privileges

• Make sure updates are coordinated based on business critical standards

• Schedule backups • Choose a “safe” remote location:

• Second internal hard drive

• External hard drive

• DVD/USB

• VHD

• Network Location

• Cassette Tape

• Incremental scheduled backups daily

• Full backup once a week

• Test the back up once a week

• Create a system recovery disk with a system image

SECURE THE ENVIRONMENT• NAP Remediation (What is it?)

• This tool is a Windows Server 2008 technology that restricts remote access based on the users PC health.

• This technology can be configured making sure that users have antivirus software up to date, Firewall enabled, and automatic updates enabled.

• If the user does not meet the set limit of security, then they cannot connect remotely

• Make sure User Account Control (UAC) levels are set to notify an administrator if an action is taking place that requires higher privileges.

• Under the Group Policy in the security node, configure user rights ensuring only the right people have access to the right data

• Audit the remote connections by running reports frequently of who has accessed the network and when

RECOVER THE ENVIRONMENT

• Schedule backups frequently, both in incremental sets and a full backup once a week• This allows you to do a full restore from the full backup then using the

incremental backups to the date and time the incident happened• Consider location in determining where the backed up data is stored• Run tests and verify backups frequently ensuring that data is valid

REFERENCES • Ashford, W. (2012, March 20). Data protection: It's often about locking the front door. Retrieved December 14, 2013, from ComputerWeekly.com

website: http://www.computerweekly.com/news/2240147051/Data-protection-Its-often-about-locking-the-front-door

• Data Loss Statistics. (n.d.). Retrieved December 15, 2013, from Boston Computer Network website: http://www.bostoncomputing.net/consultation/databackup/statistics/

• McLean, I., & Thomas, O. (2010). MCTS Self-Paced Training Kit (Exam 70-680): Configuring Windows 7. Redmond, WA: Microsoft Press.

• Miller, R. (2010, April 5). Earthquakes and Data Centers. Retrieved December 14, 2013, from Data Center Knowledge website: http://www.datacenterknowledge.com/archives/2010/04/05/earthquakes-and-data-centers/

• Miller, R. (2012, October 30). Massive Flooding Damages Several NYC Data Centers. Retrieved December 13, 2013, from Data Center Knowledge website: http://www.datacenterknowledge.com/archives/2012/10/30/major-flooding-nyc-data-centers/

• Miller, R. (2012, November 4). In Sandy’s Aftermath, Epic Challenges for Data Centers. Retrieved December 15, 2013, from Data Center Knowledge website: http://www.datacenterknowledge.com/archives/2012/11/04/data-center-industry-links-for-november-3rd/

• Smith, D. M., PhD. (2003). The Cost of Lost Data. Retrieved from Graziado Business Review website: http://gbr.pepperdine.edu/2010/08/the-cost-of-lost-data/

• Statistics about Leading Causes of Data Loss. (n.d.). Retrieved December 14, 2013, from Protect Data website: http://www.protect-data.com/information/statistics.html