Let's continue looking at Business Continuity,
Disaster Recovery,
and Incident Response for the Certified in Cybersecurity course.
Now let's take a look at the third part of this, disaster recovery.
We looked earlier at this slide about the outcomes of a
business continuity management system,
and we said the three parts incident response planning was,
first of all, concerned with life safety,
containment, documentation, and getting back to normal.
Business continuity planning was based on the business impact analysis,
the critical business functions, the recovery time objective,
the data recovery point objective, and the various recovery requirements.
Now when we look at disaster recovery planning,
we're looking primarily at the relocation of IT and
other services to an alternate location.
Our primary location has been damaged, we can't use it,
so we need to recover by rebuilding systems,
for example, our processes, at another place.
When we choose those other places, we could call that our recovery site,
there is a number of factors that were used in determining
what was an appropriate recovery site.
For example, how quickly do I need to recover?
If it's 8 hours drive away,
that's maybe not something that's going to work if I need to recover in 4 hours.
So the recovery time objective drives the site selection,
but we also know that if I need to recover very quickly,
it's probably going to cost me more as well.
So in some cases, the fastest recovery would be having redundant sites,
if one fails, the other is still running,
but that doubles my cost of operation.
So quite often, we choose a less expensive option, such as a warm site.
We also have to look at how are we going to prioritize our systems recovery.
We want to prioritize by recovering the most critical business processes first.
Now most critical could be from a financial perspective or it
could be from a reputational perspective as well.
We also realize there are challenges.
If I have a recovery site too far away,
it could be difficult to manage when I have employees and systems at
different sites based on a course process criticality.
So the selection of that contingency site is going to bring in a
number of factors such as what would it cost,
what's its availability, can I be sure it's there when I need it,
and will it help me meet my recovery time objective?
I want it close enough,
but not so close that it could be affected by the same
threat that damaged my primary site, so proximity is a consideration.
We want to have a site which is secure so we don't
have to worry about other problems, for example,
relocating the site which itself would be under an immense threat.
We also have to worry about employees.
They need to get to that site,
and logistics is often missed in disaster recovery plans.
How can my employees get to this alternate site?
If they have to work there for the next 6 months to a year,
that may not be so easy if that site is hours drive away
and there is no public transit available.
We also want to make sure we have support,
whether or not we're discussing power, fire,
police, ambulances, food,
all of these are important for the recovery site as well.