Lessons Learned From Hurricane Sandy

1. Review the key phases of disaster recovery as outlined in chapter 10 of the textbook.

Disaster Recovery is an important process in Information Security, when it occurs, we need system to get back on track as quickly as possible. There are five phases of disaster recovery as outlined in chapter 10 by authors (Whitman, Mattord & Green, 2013).

Preparation:

The preparation phase takes into account the activities which need to be taken care of before disaster occurs. This phase includes providing education, training and assistance to deal with disaster whenever it occurs (Borysowich, 2015).

Response:

The response phase is all about how to respond to the disaster. In the response phase, the situation must be analyzed, and a decision should be made concerning the cause and its suitable action (Borysowich, 2015).

Recovery:

After the response phase ends, where analysis and decision making has been done, the recovery phase starts. The period of recovery phase can be short, medium or very long based on the intensity of the disaster (Borysowich, 2015).

Resumption:

Resumption phase works toward restoring other operations of the organization that have affected badly due to the disaster and makes an effort to start the services and keep the normal operations going up and running smoothly (Borysowich, 2015).

Restoration:

The final phase of disaster recovery plan is restoration where the disaster has been managed and this phase gets the organization back into action by restoring all the affected operations. The resourced and teams are moved back to their original positions. This phase assures that none of the effects of disaster are unanswered and all the issues have been tackled properly (Borysowich, 2015).

2. Briefly discuss the disaster recovery phases in chapter 10 and their relation to the lessons learned from Hurricane Sandy article.

Sarabacha (2019), states the lessons learned after Hurricane Sandy and provides suggestions and advises how such situations can be handled in a better manner.

Preparation:

The preparation phase carries out activities like arranging recovery sites, developing training, providing storage of materials and many more. Sarabacha (2019) feels, that it is also equally important to look after employees, in the case of disasters. Employee’s first priority will always remain their family and home and as an organization, it is their responsibility to help them protect their loved ones.

Organization should also keep in mind that the employee cannot always work from home. Incidents like Hurricane Sandy and Hurricane Katrina can impact a whole city and with such wide impact, there is always chance of having power failure which may result in failure to work from home. Therefore, organization should have a backup plan to mitigate such situations with respect to employees.

Response:

If the preparation for disaster recovery is done well, then response can be minimal. The response phase needs to a have a step by step approach which can help in the decision-making process. Sarabacha (2019) suggests that disaster recovery plans should have a clear vision and a good decision-making approach to take corrective actions. He further states that companies should have different business continuity plans for different types of disasters. The disaster plan and Business continuity plans should always be tested to check wheter they are working in conjunction or not.

Recovery:

Recovery is essential after each and every disaster. Based on the impact of disaster, recovery can take time to repair or rebuild the application or a construction. After hurricane sandy, the communication was lost and phones were not working hence, Sarabacha (2019) suggested that Satellite phones should be used to carry out communication. Phelps (2019) commented, that having backup locations close to each other can create chaos as it created in the case of hurricane Sandy which disrupted both or multiple backup locations of many organizations and they did not have any access to their data. The recovery phase requires strategy implementation and planning to secure and resolve the issues, needs of the organizations, community and other related systems.

Resumption:

Having cloud-based systems can be beneficial in the time of disasters. Since such systems can be accessed via internet, and also the data storage remains in cloud, provided we have the Internet connection, cloud-based systems can continue to work in spite of disasters. Phelps (2019) states, that untested recovery strategies can result in disaster mitigation failure. This can make the whole working system even worse. One should always be careful about the DRP and BCP which is not ever tested.

Restoration:

Organizations have now understood the importance of having two data centers as the recovery becomes quite manageable. It is not guaranteed that you can recover data in a moment, however with time and patience the data can be recovered from the backup server. It is also important to have an idea about the vendor’s disaster recovery and business continuity plans. This is required to analyze how much impact the disaster can have on the dependencies of an organization.

3. Discuss how you would alter sample plan based on the lessons learned from Hurricane Sandy Article. (Do not give me a copy of the altered plan, simply explain in the paper what you would alter)

• The DRP upgrading process should be properly defined and the DRP and BCP should be updated and tested periodically.
• The plan documentation should be securely stored on multiple backup locations to access it in case of an emergency.
• An email alert or message alert should be prepared in case of disaster to few key employees and sent out in case of disaster.
• McNutt & Leshner (2013), comment on the fact that lessons learned over the years will not make the planning restore all the operations to its normal form.
• It is also required that only authorized individuals will be shared all the critical and crucial information regarding disaster and only they are responsible to deal with media.

References

1. Borysowich, C. (2015). Phases of a Disaster Recovery Plan. Retrieved from https://it.toolbox.com/blogs/craigborysowich/phases-of-a-disaster-recovery-plan-110415
2. Phelps, R. (2019). Lessons Learned from Hurricane Sandy. Retrieved from https://ems-solutionsinc.com/wp-content/uploads/2013/02/Lessons-From-Hurricane-Sandy.pdf
3. McNutt, M. & Leshner, A. (2013). Response and Recovery Planning. Retrieved from: https://www.ncbi.nlm.nih.gov/books/NBK464149/
4. Sarabacha, D. (2019). Disaster Recovery: 10 Lessons from Hurricane Sandy. Deloitte
5. Schmeltz, M. T., González, S. K., Fuentes, L., Kwan, A., Ortega-Williams, A., & Cowan, L. P. (2013). Lessons from hurricane sandy: a community response in Brooklyn, New York. Journal of urban health, 90(5), 799-809.
6. Whitman, M. E., Mattord, H. J., & Green, A. (2013). Principles of incident response and disaster recovery. Cengage Learning.