Disaster Plan
Nunki J Rosas
IT/240
Sunday, April 7th, 2013.
John Helt, MISM, MCSE

Disaster Plan
Scenario:
The IST Department of XYZ Computers is located on the first floor. Payroll and all human resources records are processed daily and bi-weekly for 10,000 employees. After payroll is run, data is backed up using tapes. No firewall is in place, and e-mail is on the same server as payroll.
XYZ Computers is located in the southern part of the United States in an area that receives heavy rain. During the weekend, a major water pipe broke and flooded the first floor. The water caused extensive damage to the servers, which were also on the first floor. Create a disaster plan to prevent this sort of problem from happening in the future.
Proposed solution:
The way in which XYZ Computers has their IST Department set up currently is susceptible to many threats. The lack of a firewall is an open invitation for data to be stolen by prying eyes, and the vulnerability of placing the payroll database is in the same server as the email service. The geographic and weather conditions of the location of the company have a high risk of flooding, yet the Servers were installed on the first floor. Lastly, the backup method in place is sort of outdated and there is no mention on how often the backup takes place; additionally, the backup tapes themselves could be damaged, lost, or stolen. These recommendations are an attempt to improve XYZ Computer’s network data security, prevention of data loss, protection against network failure, and contingencies for natural disasters.
First and foremost, there has already been an incident where the network servers were damaged due to flooding in their physical location. It is then logical to start by redesigning the physical configuration of the servers, placing them on a higher level floor (assuming there are several floors to the XYZ Computer’s company building). Relocating the IST department should not be a lot of trouble, but will prove to be a valuable strategy to prevent network failure and data loss; which directly impacts productivity. The new configuration for the IST department should take in consideration the typical natural disasters they are susceptible to and position the servers in a manner that they are protected from them.
Secondly, the backup method for data needs to be updated. Instead of using backup tapes, the company can use a redundant disk system based on RAID technology. Tomsho (2011) stated, “Redundant disk systems can prevent data loss in the event of a disk failure; in fact, a system with a redundant disk configuration can continue operating with no downtime.” (p. 447). Therefore, by implementing disk mirroring for example, the hard disks on the server containing the payroll database would be a synchronized copy of one another. Then if one of the drives fails, the other one kicks in allowing the system to continue operating. Also, the email service should be moved to a different server as the one used for the payroll database because of the vulnerability of attacks and threats of computer viruses which can infiltrate the system through the email service port. Strong network security software should be put in place to protect the network from said threats, with a good performance firewall and real-time scanning of files in order to detect any kind of attack or even an attempt of attack.

Besides the backup and network data protection, the possibility of power outage must be considered. For this reason it would be necessary to use redundant power supply (RPS) and uninterrupted power supply (UPS); which according Tomsho (2011), would ensure the system has a consistent power flow and provide power temporarily in the event of an outage. An RPS makes sure there is a secondary power supply ready to kick in when necessary and it also helps regulate any fluctuations in power which could result in damage to the computer hardware. The UPS provides surge protection and has a built in battery which will keep the computer running until power is restored, or the system is properly shut down. When there is a power fluctuation or outage, the system will reboot itself causing the users to lose data they were currently working on, and can also damage the hard drives of the system servers when it is not shut down properly. Data can become corrupted and/or completely lost, in some cases rendering the whole system useless until the backup is restored. Therefore, all essential components of the network (servers, hubs, switches, etc.) should be protected in one way or another against power failure and damage due to power overloads.

In addition to the disk mirroring for back up, XYZ Computer’s payroll database should be backed up to an external device on a regular basis. This device should be then kept secure, and if possible, at a different location than the rest of the network servers as a backup redundancy. It would also be recommended that the data of such backup be encrypted to add an extra layer of security due to its sensitive nature. A different route of protecting the information is by using the RAID 5 method which works by spreading data across multiple disks and using one disk in each write operation to store parity information. Parity information is generated by a mathematical calculation on data being written, so if one of the disks fails, his information can be used to re-create lost data from the failed disk (Tomsho, 2011). This method could be chosen over the first recommendation because it reduces the work load and allows for a faster system. An important change to the configuration of the servers is to start using server clustering with at least two servers functioning as one unit in which the payroll database is contained. If these two servers can have a different geographic location, it would be a great backup alternative; but even if implanted within the same building, it will ensure a continuous network operation.

All of the above recommendations can be fine-tuned by obtaining additional specific information form the company such as the type of computer threats they have been prey to, the workload on the network, user’s credentials and permissions within the network, and any other relevant data to help identify vulnerabilities. Since the most important part of this disaster plan is the relocation of the IST department, there is an opportunity to upgrade and add any additional components to the network in order to make it more secure and efficient. Payroll information is one of the most sensitive databases within a company, so special consideration needs to be applied to protect the loss of data internally, as well as any potential outside threat to this data. I would strongly suggest the use of RAID 5 method for backup and consistency of information along with security software that would allow monitoring the access to the payroll database and protecting it from unidentified intrusions.

Reference:
Tomsho, G. (2011). Guide to Network Essentials (6th ed.). Clifton Park, NY: Cengage Learning.