Contingency planning and disaster recovery : protecting your organization's resources

목차 (Table of Contents)

• CONTENTS
• Introduction = 1
• 1. Executive Summary = 5
• Hardware Focus = 7
• Grandfather-Father-Son Backup = 8
• Beyond Backup : Reading Critical Data Sets = 10
• From Data Center to Business Recovery = 10
• A Critical Year = 11
• No Longer a Hard Sell = 12
• The Regulatory Imperative = 14
• From Acknowledgment to Planning = 14
• The Rest of the Story = 16
• Corporate Necessity or Expensive Indulgence = 18
• 2. Disaster Recovery Alternatives = 19
• Reciprocal Agreements and Pooling Resources = 20
• Balancing Act = 21
• Gaining Momentum = 22
• What Should a Company Do? = 22
• Backup : The Bare Minimum = 23
• Electronic Vaulting = 24
• Backup Plus = 26
• Incremental Backup = 27
• Disaster Insurance : Limiting Loss = 28
• Business Recovery Planning = 30
• Testing = 30
• No Plan Is Disaster-proof = 33
• 3. Strategic Issues = 35
• Probability Versus Reality = 35
• Window of Vulnerability = 36
• The Critical Time Factor = 37
• Business Impact Analysis = 38
• Business Resumption Planning = 39
• Software Can Help = 40
• Who Is in Charge? = 40
• Management Support and Legal Liability = 42
• Changing Vulnerabilities = 43
• Computers and Terrorism = 45
• Computer Crime and Security = 46
• 4. Disaster Recovery in New Environments = 51
• Network Risks and Redundancy = 51
• Telecommunications Disruptions = 55
• Network Protection = 56
• Global Connection Problems = 58
• LAN Disaster Recovery = 59
• Islands of Automation = 61
• Mission-critical Applications = 61
• Ignoring PC／LAN Contingency Planning = 63
• Following the Mainframe Game Plan = 64
• Client Backup = 67
• Mobile Backup and Data Protection = 68
• Mainframes, LANs, and Security = 70
• Securing and Protecting LANs = 71
• Methods of Attack = 72
• Other Security Threats = 72
• Protection Options = 73
• Network Security = 74
• Extending Mainframe Security Tools = 78
• Changing Ground Rules = 78
• New Trends Affecting Disaster Recovery = 81
• 5. Security Risks of the Internet and the Web = 83
• Types of Risks = 83
• Physical Security = 84
• The Danger of Computer Seizure = 84
• Hacking the Phone System = 84
• Tapping Physical Links = 85
• Network-based Risks = 85
• Dangers of the Internet as a Transmission Medium = 86
• IP Spoofing = 87
• Session Hijacking = 88
• Viruses : The Computer-based Plague = 88
• Trojan Horse Viruses = 88
• The Macro Virus Threat = 89
• Rumor Viruses = 91
• Boot Sector Viruses = 91
• Protecting Against Viruses = 92
• Consumer Scams = 92
• Denial-of-Service Attacks = 93
• Password Theft = 93
• Operating System and Software Vulnerabilities = 94
• Web Server Risks = 94
• File Transfer Protocol Risks = 95
• E-mail Risks = 95
• Telnet Risks = 96
• Web Server Security Issues = 97
• Web Server Information Leaks = 98
• Host Security for Web Servers = 99
• Reviewing System Logs = 99
• Who Runs the Server? = 99
• Server-side Includes and Other Configuration Issues = 100
• Allowing Web Server Access = 100
• Servers, Servers Everywhere : Employee-launched Servers = 101
• Secure CGI Scripts = 101
• Executing Commands via CGI Scripts = 102
• Hidden Form Variables = 102
• Statements to Avoid = 103
• Where to Keep CGI Scripts = 103
• Search Engines, Agents, and Security = 103
• Security Issues for Web Users = 104
• Java Security Implications = 105
• Decaf = 107
• Netscape's JavaScript = 107
• Web Security Resources = 108
• 6. Setting Goals and Developing Plans = 109
• The Plan = 110
• Obtaining Senior Management Commitment = 112
• Conducting Business Impact Analysis = 112
• Scoping the Project and Defining Objectives = 113
• Evaluating and Selecting Recovery Planning Tools = 113
• Determining the Team Structure and Roles = 113
• Planning = 113
• Testing = 114
• Maintaining the Plan = 114
• The Auditor's Role = 114
• Why Policy First? = 117
• Security Goals = 119
• Steps in Developing Policies = 119
• Determine Which Assets Need Protection = 119
• Discuss Desired Internet Access = 120
• Determine What Threats Exist = 121
• Explore Methods to Address the Threats = 123
• Conduct an Impact Assessment = 124
• Draft a Security Policy = 125
• Develop an Information Systems Implementation Plan = 126
• Develop Information Systems Procedures = 127
• Develop a Computer Use and Internet Access Policy = 129
• Review and Final Approval = 132
• Educating Users = 132
• Enforcing Security Policies = 133
• If a Breach Occurs = 133
• Security by Design = 134
• Security Organizations = 135
• Computer Emergency Response Team = 135
• Computer Incident Advisory Capability = 137
• Forum of Incident Response and Security Teams = 137
• National Center for Supercomputing Applications = 137
• Outsourcing Security = 137
• Information Systems' Critical Role in Security = 138
• Getting Security into the Budget = 138
• Conclusion = 138
• 7. Testing Recovery Strategies = 141
• Process Mind-set Required = 142
• Failure or Feedback = 144
• True or Mock Tests = 144
• Smoothing the Rough Spots = 145
• Creative Testing = 146
• Using Tools for Testing = 146
• Critical Success Factors = 147
• 8. Broadening the Scope of Contingency Planning = 149
• Disaster Recovery Integration = 150
• Scheduling Systems = 151
• Disaster Recovery Team = 152
• More About Disaster Recovery Elements = 154
• UPS Protection = 154
• Cryptography Techniques = 155
• 9. Getting Started = 159
• Disaster Recovery Vendors = 161
• Alternate Phone System = 162
• Archival Storage = 162
• Off-Site Storage = 163
• Evaluating the Safe Site = 164
• State-of-the-Art Facility = 166
• Hospital Recovery = 167
• From System to Application Recovery = 170
• Conducting Risk Analysis = 170
• Plan Evaluation Through Testing = 173
• 10. Conclusion = 175
• Repercussions of Downsizing = 175
• The Complexity Factor = 175
• Application Focus = 176
• A Business Issue = 177
• Disaster Proofing = 177
• Outsourcing = 178
• Coming of Age = 178
• APPENDICES
• A. Addresses of Contacts = 183
• B. Disaster Recovery Products = 187
• C. CERT Incident Reporting Form = 193
• Glossary = 203