IT Continuity in the Face of Mishaps

Introduction

Adversity planning has come to the forefront of the public’s concerns because of both the scope and frequency of news making natural disasters. “Ordinary” computer and networking failures, no matter how far reaching the consequences and importance of the entities affected, are reported with such regularity as hardly to cause a stir in the public arena—except among those affected, for example, the investment community (Campbell, Gordon, Loeb, & Zhou, 2003; Cavusoglu, Mishra, & Raghunathan, 2004). Both these realizations point to the need for reassessing the nature of past and probable future problems as well as instituting effective preventive and recovery measures. A theoretic context is provided for the subsequent discussion of disasters.

This chapter considers topics related to disasters in a natural progression:

• •

  What we think about disasters in general and why we need to revise the conventional “wisdom” about disasters

• •

  Why disaster matters so much—its consequences

• •

  Legal requirements and methods for disaster planning

• •

  How to be successful in minimizing loss from a disaster and instituting controls

• •

  Ensuring physical security

• •

  Post-disaster IT` continuity and recovery

Revising Common Assumptions About Disaster

First we need to revise our assumptions about disasters:

• 1.

  Catastrophes occur independently of one another. Comment: Any given disaster may be due to a cause that does not disappear after the first strike. Malware creators propagate their exploits in waves.

• 2.

  Disasters tend to repeat themselves with only minor differences.

• 3.

  In the short term, the chances of experiencing a calamity are low.

• 4.

  It is unlikely that a calamity like the last one will occur any time soon.

• 5.

  The number of calamitous events in any narrow timeframe or given place will be constant over time

With knowledge gained through bitter and repeated experience, organizations would do well to call into question the guiding assumptions mentioned above and consider the following points (which counter the above assumptions):

• 1.

  Weather, seismic, and especially socially caused traumatic events seem to feed off one another.

• 2.

  Greater communication and transportation resources are now available to ill-intentioned people. Comment: Even without any apparent communication, a relatively recently noted phenomenon is the simultaneous discovery and creation of new behaviors—both good and ill—in geographically separated locales. Ideas, which crop up in one place, may arise in another at approximately the same time. This situation is evidently part of nature. For instance, Japanese primatologists observed a single macaque monkey who learned how to wash sweet potatoes before eating them and that this learned procedure spread to the entire troupe (Narby, 2005). Other instances of primate learning have spread to other locations without any apparent communication.

• 3.

  Increased extremism and climatic changes (brought about by greater industrial activity, perhaps) trigger more human-made disasters.

• 4.

  Ideologically motivated damage and employee sabotage are increasingly the norm.

• 5.

  One calamitous event can be seen to stimulate a recurrence rather quickly. An instability here and now augments instability later and nearby.

• 6.

  The pace of adverse happenings is quickening.

• 7.

  New kinds of items causing disaster are emerging, for example, denial of service attacks, rootkits.