Cyber Security Strategy Business Continuity Plan

Cyber Security Strategy Business Continuity Plan

Conventionally, there are three basic types of standby system – cold, warm and hot – although there are variants within these. Most well-designed standby operations will ensure that there is an effective physical separation between the ‘active’ and ‘standby’ systems, since the loss of a data center or computer room containing both systems would clearly result in no recovery capability.

Cold standby systems frequently make use of hardware platforms that are shared by a number of organizations. They may have power applied, and may also have an OS loaded, but they are unlikely to have much, if any, user application software installed, since each organization’s requirements will be subtly different. There will also be no data loaded.

This is the least effective method of restoration, since it may take a significant amount of time and effort to load the operating system (if not already done), to load and configure the user applications and to restore the data from backup media. It will, however, invariably be the lowest cost solution for those organizations who are able to tolerate a longer RTO.

Another disadvantage of cold site standby systems is that if they are shared with other organizations, there may be a conflict of resources if more than one organization declares an incident at, or around, the same time. An example of this was the situation on 11 September 2001, when the attacks on the World Trade Center in New York took place. Most organizations had disaster recovery plans, but a number of them relied on the same providers, which completely overwhelmed their capabilities.

Warm site standby systems will generally be pre-loaded with operating systems, some or all user applications, and also data up to a certain backup point. This means that the main task is to bring the data fully up to date, and therefore much reduce the restoration time required.

Warm site standby systems are invariably costlier to provide then cold standby, and it is common practice for organizations to use one warm standby system to provide restoration capability for a number of similar systems where this provides an economy of scale. Additionally, those organizations who regularly update their application software may make use of their warm standby systems as training, development and testing platforms before a new or updated application is taken into live service.

Hot site standby systems come in several flavors, but increasingly, and especially where no outage time can be tolerated at all, high availability systems are becoming the norm. A basic hot site standby system will be as similar as possible in design to a warm standby system, except that the data will be fully up to date, requiring a real-time connection between the active and standby systems. Two slightly different methods of synchronizing the systems are in common use – the first (and faster) method is known as asynchronous working, in which the active system simply transmits data to the standby, but continues processing without waiting for confirmation that the data has been written to disk. The second, slightly slower (but more reliable) method is known as synchronous working, in which the active system transmits data to the standby and waits for confirmation that the data has been written to disk before it continues processing.