• United States



Guess what! Can you trust your plan?

Aug 19, 20083 mins
Business ContinuityData and Information Security

Incident response plans, disaster recovery plans, and business continuity plans are essential components in a well-developed information security program. If you aren’t regularly testing your plans, then you are gambling with the future of your business.

Nothing within the realm of information technology is, or should be a gamble. The very concept of a “grey area” violates the binary nature of modern technology. Despite this many organizations don’t test their recovery and continuity plans. To these organizations I say wake up! When (not if, but WHEN) the time comes that you have to activate your plan, rest assured that you’ll be running around with your pants around your ankles while Rome burns.

I know what your thinking, testing is expensive, time consuming and boring. It’s best to think of it as insurance against the inevitable. I know that when it comes time to approve your budget that the CEO wants to forget you much like he tries to forget the rash that he brought back from the rodeo clown in Vegas. Nonetheless, testing is imperative. A plan that hasn’t been tested is really just a guess. You’re guessing that the actions that you define in your plan will work. You’re guessing that you’ll be able to continue operations. You’re guessing that you’ll be able to recover your customer database. Most importantly, you’re guessing that you’ll have a job when this is all over.

As for boring, just sell the testing exercise as a role playing game. System administrators love role playing games. Tell them its a live action version of Dungeons and Dragons! Heck, buy them some plastic swords and helmets… on second thought, save that money. They’ll probably already have costumes… I mean “battle gear”. Gather Sir Linux-alot and his minions together and test your plan from start to finish. I can pretty much guarantee that you will find things that don’t work and that’s actually good. The goal of this exercise… I mean mission is to look for those things and fix them. It’s a heck of a lot easier to fix them in a normal environment than it is to fix them when your in the dungeon… I mean recovery mode. When it’s all over, you’ll have a plan that you can feel confident in and your staff will know what they are supposed to do when the grog hits the fan, er dragon.

One a side note, be prepared for massive requests for changes to the dress code. Once you open the door to your staff wearing animal pelts and wizard robes into the office, there’s no closing it.

Chad McDonald, CISSP, CISA, C|EH, PMP is a Senior Professional Services Consultant with Imperva. Chad has worked previously at National Student Clearinghouse, Centers for Disease Control and Prevention, Georgia Department of Audits and Accounts and is the former Chief Information Security Officer at Georgia College & State University. Chad has addressed numerous groups on topics such as business continuity planning, incident response, and information security awareness. Chad has spent the bulk of his career building, managing, and assessing information security for educational and research organizations. Chad has earned multiple professional security certifications. He is a member of the Information Systems Audit and Control Association as well as InfraGard, an FBI Task Force charged with protecting the nation's information infrastructure. Chad is active in the security community He worked with law enforcement agencies to assist in the prosecution of the first computer crime on record in Georgia and continues to assist local and state authorities with computer based investigations. Chad has investigated computer and computer-related crimes for local and state law enforcement agencies. Chad is an avid Mac user, since he was rescued from the dark side eight years ago. He currently conducts the vast majority of his work using a MacBook Pro and a MacBook. Chad looks forward to the day that he can stop referring to himself in the third person and actually pay someone to write his bio for him. The opinions and statements expressed here are those of Chad McDonald and in no way reflect opinions or statements of any employer or organization with which Chad is affiliated.