Incident Response And Disaster Recovery

Front 1

disaster recovery planning

Back 1

the preparation for and recovery from a disaster, whether natural or man-made.

Front 2

acts of terrorism

Back 2

cyber terrorism or activism

Front 3

rapid onset disasters

Back 3

occur suddenly with little warning, taking the lives of people and destroying the means of production (i.e. earthquakes, floods, storms, tornadoes, or mud flows).

Front 4

slow onset disasters

Back 4

occur over time and slowly deteriorate the capacity of an organization to withstand their efforts (i.e. droughts, famine, environmental degradation, deforestation, and pest infestation).

Front 5

Earthquake

Back 5

Can cause direct damage to all or part of the information system or, more often to the building that houses it. May disrupt operations by interrupting access infrastructure. Can be mitigated with a specificseparate insr. policy.

Front 6

electrostatic disharge (ESD)

Back 6

Can be costly or dangerous if it ignites flammable mixtures and costly components. Can cost loss of production time. Not really viewed as a threat. But, can be covered by a business interruption plan.

Front 7

disaster recovery program

Back 7

provides direction and guidance of any and all disaster recovery operations and the development and support for the disaster recovery plan

Front 8

trigger

Back 8

a point at which a management decision to react is made in reaction to a notice or other data such as a weather report or an activity report from IT. Most come as a response to a one or another natural event.

Front 9

actions after phase

Back 9

lost or damaged data is restored, systems scrubbed of infection, and essentially everything is restored to its previous state.

Front 10

follow-on incidents

Back 10

Are highly probably probable when infected machines are brought back online or when other infected computers that may have been offline at the time of the attack are brought back up.

Front 11

forensics analysis

Back 11

the process of systematically examining information assets for evidentiary material that can provide insight into how an incident transpired.

Front 12

after-action review

Back 12

a detailed examination of events that occurred from first detection to final recovery. All team members review their actions during the incident and identify areas where the IR plan worked, didn't work, or should improve.

Front 13

servers

Back 13

support file sharing and storage, data processing, central application hosting (such as e-mail or a central database), printing, access control, user authentication, remote access connectivity, and other shared network services.

Front 14

website contingency solutions

Back 14

should ensure the reliability and availability of the website and its resources. The website's infrastructure must be considered carefully.

Front 15

local area network

Back 15

is owned by a single organization. It can be as small as two PCs attached to a single hub or it may support hundreds of users and multiple servers.

Front 16

contingency strategies

Back 16

should emphasize the mainframe's data storage capabilities and underlying architecture.

Front 17

redundant system components

Back 17

Are critical to ensure that a failure of a system component such as a power supply, does not cause a system failure.

Front 18

mitigation of impact

Back 18

the inclusion of action steps to minimize the disaster-associated damage on the operations of the organization.

Front 19

crisis management

Back 19

a set of focused steps that deal primarily with the safety and state of the people from the organization who are involved in the disaster.

Front 20

degraded mode

Back 20

operations under adverse conditions or less-than-ideal circumstances such as loss of power or lighting, loss of communications (phone or network), and so on.

Front 21

communication team

Back 21

trains by preparing information notices, news releases, and internal memorandums and directives to provide information to all groups and teams as to what their current tasks and responsibilities are.

Front 22

network recovery team

Back 22

The team responsible for reestablishing connectivity between systems and to the Internet (if applicable). May be used to replacing downed systems.

Front 23

storage recovery team

Back 23

the team responsible for the recovery of information and the reestablishment of operations in storage area networks or network attached storage.

Front 24

applications recovery team

Back 24

the team responsible for recovering and reestablishing operations of critical business applications.

Front 25

data management team

Back 25

the team primarily responsible for data restoration and recovery. Their training correspondingly focuses on quick and accurate restoration of data from backup.

Front 26

business interface team

Back 26

the team responsible for working with the remainder of the organization to assist in the recovery of non technology functions.

Front 27

logistics team

Back 27

the team responsible or providing any needed supplies, space, materials, food, services, or facilities needed at the primary site-other than vendor-acquired technology and other material obtained by the vendor team.

Front 28

internal testing

Back 28

can include employees conditioning self-assessments after an exercise by completing feedback surveys indicating what they thought worked well and what didn't.

Front 29

external testing

Back 29

can come from standardization groups, or consultants, certification or accreditation groups, or a group selected by the organization's management from a sister company.

Front 30

DR plan desk check

Back 30

involves providing copies of the DR plan to all teams and team members for review.

Front 31

DR plan structured walk-through

Back 31

all involves individuals walk through the steps they would take through an actual disaster, either on site or as a conference room discussion.

Front 32

DR plan parallel testing

Back 32

Individuals or teams act s if and actual disaster occurred, performing their required tasks and executing the necessary procedures, without interfering with the normal operations of the business.

Front 33

DR plan full-interruption

Back 33

The individuals follow each and every procedure, including the interruption of service, restoration of data backups, and notification of appropriate individuals.

Front 34

DR plan war gaming

Back 34

state and federal-mandated emergency readiness to prepare for terrorist strikes. Not very many venues for this practice. There is little work in this area.

Front 35

DR plan alert roster

Back 35

must have a mechanism to contact everyone in the organization, especially if part of the message is "don't report to work today, but call this # for more info."

Front 36

reponse phase

Back 36

the phase associated with implementing the reaction to a disaster facing the organization and is focused on those actions designed to control or stabilize the situation, if that is possible. Involver activating the DR plan and following the steps outlined therein.

Front 37

recovery phase

Back 37

the phase where the organization begins the recovery of the most time-critical business functions-those necessary to reestablish business operations and prevent further economic and image loss to the organization.

Front 38

resumption phase

Back 38

focuses on the functions that are not critical.

Front 39

restoration phase

Back 39

Considered the final phase of the disaster recovery plan implementation, the organization conducts the operations necessary to rebuild the facilities and reestablish operations at "home base."

Front 40

standing down

Back 40

represents the deactivation of the disaster recovery teams, releasing individuals back to their normal duties.