The InfoSec Blog

System Integrity: Context Is Everything

Navigation
  • About The Author
  • Presentations
  • System Integrity
You are here: Home › Failures › Why don’t companies apply more risk analysis – Part 2
← Why don’t companies apply more risk analysis?
The wedge gets thicker →

Why don’t companies apply more risk analysis – Part 2

25 November, 2009 | Filed under: Failures, Human Factors, Rants and Raves, Risk, Security, Social and tagged with: Business and Economy, Greater Toronto, Intellectual property, Ontario, Technology, Toronto

And while on that subject …

“Consult Human Resources when making disaster recovery plans”

Every DR plan I’ve seen has failed to take into account human factors.
The most basic of which is that if there is any one of a large number of disaster scenarios, how are staff going to get in to the DR site?

360-degree panorama of Toronto, Canada, as see...
Image via Wikipedia

So: here we are in Toronto and the DR site is in Arizona …
what sort of disaster will take out Toronto and let all the staff here track down to Arizona in order to run the IT services to support the customers in, guess where?
Right: Toronto

So: here we are in Toronto and a disaster takes out the primary site.
What makes you think that the secondary site the other side of Toronto or few blocks away, as is the case for one major bank, isn’t also going to be affected?

So: the primary site is OK but a tractor-trailer overturned in the highway, the 401 (see google maps) across the city and half or more of you staff can’t get in to work and can’t telecommute ‘cos they are trapped on the congested but unmoving highway

I’m not being very imaginative here. The first two are from actual clients and the third has occurred quite a few times.

I know here the IT sites and call centres of the primary banks and Telecom firms are here in Toronto and from a DR/BC perspective there’s a great deal of stupidity. They may have the technology side worked out,
backups, UPS, hot, warm and cold, accelerator microcode, routing and all that, but not the people side.

That’s why I said in an earlier post in this thread

No, technology is easy, people are hard to figure.

Some DR plans I’ve seen even admit they can’t address the people side of things, they say so in their ‘assumptions’ section, but do so in a mealy-mouthed way that downplays the fact that these plans are unworkable.

Related articles by Zemanta
  • Heat alert issued for Toronto (cbc.ca)
  • Heat alert issued for Toronto (thestar.com)
Reblog this post [with Zemanta]

Did you like this article? Share it with your friends!

Written by Anton Aylward

Security Evangelist

Visit my Website
← Why don’t companies apply more risk analysis?
The wedge gets thicker →

Leave a Reply Cancel reply

You must be logged in to post a comment.

Calendar

November 2009
M T W T F S S
« Oct   Dec »
 1
2345678
9101112131415
16171819202122
23242526272829
30  

Search

Archives

Tag Cloud

Access control Apple Botnet Business Business Continuity Planning Certified Information Systems Security Professional CISSP Computer security Confidence trick Consultants controls Donn Parker Editing English language FMEA fraud HP Individual Standards Information security infosec International Organization for Standardization IPad IPhone ISO/IEC 27001 Laptop laptops Law Linux Malware Management Microsoft Open source owasp Policy Risk Risk analysis Risk assessment Risk Management Security Site Management Standards statistics Technology United States Vulnerability

Meta

  • Log in
  • Entries RSS
  • Comments RSS
  • WordPress.org

Popular Pages

  • The Classical Risk Equation
  • Separation of Duties: Infosec, IT and Audit
  • “Cybercrime” is still Crime and “Cyberfraud” is still Fraud
  • Risk Analysis makes no sense … Does it?
  • Are *you* ready to give up yet?
  • Why InfoSec Positions go unfilled
  • Security
  • Risk

Categories

Advisories & Vulnerbilities

  • bugtraq @ insecure.org
  • SANS Security Alerts
  • SANS Storm Center
  • Secunia Advisories
  • Symantec Security Response – Advisories
  • Symantec Security Response – Resent Viruses

Blogroll

  • Augusto Paes de Barros
  • Bob Johnston
  • Daniel Accioly Rosa
  • Deep Litter
  • DHS Daily Report
  • Eduardo Neves
  • Emergent Properties
  • Gary Hinson
  • Hayden’s Harangues
  • Martin McKeay
  • Schneier on Security
  • The Quiet Earth
  • The Security Team
  • Watchguard Wire

Security Links

  • CERT-CC
  • E2K Security
  • focus-ids @ insecure.org
  • fulldisclosure @ insecure.org
  • Identity mangement news
  • Incidents
  • InfoWorld- Security
  • isn @ insecure.org
  • joatBlog
  • Kill-HUP.com
  • Mark O’Neill’s Radio Weblog
  • microsoft @ insecure.org
  • Microsoft TechNet – Security
  • MSDN- Security
  • Network World Fusion NetFlash
  • Network World on Privacy
  • Network World on Security
  • Network World on Wireless Security
  • nmap-hackers @ insecure.org
  • Scott Granneman- Intellectual Property
  • Scott Granneman- Privacy
  • Scott Granneman- Security
  • Scott Loftesness- Digital Identity
  • Security Blog
  • Stupid Security
  • THE Network Security Blog – Geek Troy Jessup
  • Wi-Fi Networking News
  • Wifi Security Project

© 2013 The InfoSec Blog

Powered by Esplanade Theme by One Designs and WordPress