INFORMATION TECHNOLOGY TRACK Russell Brown Chapter 13 Standing - - PowerPoint PPT Presentation
NACTT STAFF SYMPOSIUM SERIES INFORMATION TECHNOLOGY TRACK Russell Brown Chapter 13 Standing Trustee - Phoenix, AZ Allan Reininger System Manager - San Antonio, TX Chapter 13 Standing Trustee - Mary Viegelahn Carl Brooks System Manager -
STAFF SYMPOSIUM - IT TRACK
Russell Brown Chapter 13 Standing Trustee - Phoenix, AZ Allan Reininger System Manager - San Antonio, TX Chapter 13 Standing Trustee - Mary Viegelahn Carl Brooks System Manager - Detroit, MI Chapter 13 Standing Trustee - Tammy Terry Tom O’Hern Program Manager, ICF International, Baltimore, MD STACS - Standing Trustee Alliance for Computer Security
4/14/2015
SESSION 5 - DISASTER RECOVERY 1
STAFF SYMPOSIUM IT TRACK
Day 1
Session 1 (9:00 - 10:30) - HOW TO KEEP YOUR TRUSTEE HAPPY FROM AN IT PERSPECTIVE
Session 2 (10:45 - 12:15) - A RIVERWALK THROUGH YOUR NETWORK Lunch (12:15-1:30)
Session 3 (1:30 – 3:00) - DESKTOP & SERVER MANAGEMENT
Session 4 (3:15 – 4:45) - THE CLOUD – WHO REALLY UNDERSTANDS IT? DAY 2
Session 5 (8:30 - 10:00) - DISASTER RECOVERY – YOUR WORST FEAR COMES TRUE
Session 6 (10:15 - 11:45) - BUERRITO BOWL - MIXED HOT TOPICS List of Reference Material
4/14/2015
SESSION 5 - DISASTER RECOVERY 2
STAFF SYMPOSIUM - IT TRACK
Disaster Recovery by Example Backups and the Cloud Server Virtualization
4/14/2015
SESSION 5 - DISASTER RECOVERY 3
STAFF SYMPOSIUM IT TRACK
Staff member w/o administrator rights opens an infected email
attachment containing what appears to be a valid Invoice
Other staff members report errors accessing encrypted files to the system
manager
System manager see antivirus alerts on server and calls STACS STACS helps identify infected computer which is removed from network
(time <60 minutes)
Source of infection identified, no additional infections confirmed Office reinstalls infected computer and restores prior night’s backup of
encrypted files (< 48 hours)
4/14/2015
SESSION 5 - DISASTER RECOVERY 4
STAFF SYMPOSIUM IT TRACK
Staff Attorney with administrator rights opens an infected email
attachment containing what appears to be a valid Invoice
Other staff members report errors accessing encrypted files to the system
manager
System manager attempts to clean infection and restore encrypted files Infected computer not identified and continues to encrypt shared files
from server
Undiscovered secondary infection of SPAM bot malware occurs Trustee has system manager contact STACS (1 week after infection
discovered)
4/14/2015
SESSION 5 - DISASTER RECOVERY 5
STAFF SYMPOSIUM IT TRACK
STACS goes onsite (<12 hours), helps identify infected
STACS helps correct missing/misconfigured antivirus, system
Office required to reinstall infected desktop and all servers,
Data lost and restoration of recoverable data (> 3 weeks)
4/14/2015
SESSION 5 - DISASTER RECOVERY 6
STAFF SYMPOSIUM IT TRACK
Administrator opens file attachment from staff email and
Cryptolocker encrypts 10,000 files on shares from two servers
Trustee and staff discovery issues opening PDFs Trustee has admin call STACS < 15 minutes infected PC identified and removed from
Offsite backup service check to recovery files message reads
Administrator dismissed for gross negligence
4/14/2015
SESSION 5 - DISASTER RECOVERY 7
STAFF SYMPOSIUM IT TRACK
User accounts configured with/without administrator rights Systems with properly/poorly maintained antivirus & patches Users quick/slow to notify system manager of unusual activity System/office manager quick/slow to contact STACS for help Backup and restoration process untested/tested & verified Windows XP and 2003 Server still in use
4/14/2015
SESSION 5 - DISASTER RECOVERY 8
STAFF SYMPOSIUM IT TRACK
Arbitrary deletion of file/folder discovered months later SAN or NAS Failure / Server Failure
Corruption of Virtual machine(s) over 3-5 days
System Infection
4/14/2015
SESSION 5 - DISASTER RECOVERY 9
STAFF SYMPOSIUM IT TRACK
Bankruptcy data
Expense Account data
4/14/2015
SESSION 5 - DISASTER RECOVERY 10
STAFF SYMPOSIUM IT TRACK
Electronic Disaster Recovery Kit
Microsoft Server and Seat licenses Others purchased software license Keys
Other Device Activation Keys
Backup solution license, serial numbers or keys
4/14/2015
SESSION 5 - DISASTER RECOVERY 11
STAFF SYMPOSIUM IT TRACK
Web servers, ftp, email, exchange, Exchange, IIS, SharePoint Virtual Machines
Firewall configuration backup and firmware release Wireless/Router configuration backup Managed switch configuration – Especially with VLANs NAS/SAN – especially RAID and logical volume setup Hypervisor configuration
4/14/2015
SESSION 5 - DISASTER RECOVERY 12
STAFF SYMPOSIUM IT TRACK
Desktop Files
4/14/2015
SESSION 5 - DISASTER RECOVERY 13
STAFF SYMPOSIUM IT TRACK
File Shares
Accounting Human Resources System Admin (DR Kit) Tax Returns
From Microsoft’s Sysinternals tool suite Scans directories for file permissions
4/14/2015
SESSION 5 - DISASTER RECOVERY 14
STAFF SYMPOSIUM IT TRACK
"Trustees, ask your system managers to answer these questions and show proof
Review the list with you system manager to assure all critical data is backed up and recoverable if you lost everything last night. Ask what is not backed up, and review to make sure you can live without it. Otherwise get it on the backup list."
Any suggestions on how to prepare a backup list? How to prepare a NOT backed
up list? I've been looking for some type of software that will prepare/save directory trees so that I can do this, but as yet have not found anything
How about some specific suggestions on how to prepare these backup lists. Ideally, I would like a detail listing of everything and be able to flag what is or is not backed up, but I've been looking for the last few years and still haven't found a practical way to do this.
4/14/2015
SESSION 5 - DISASTER RECOVERY 15
STAFF SYMPOSIUM IT TRACK
No disaster plan at all No disaster plan, but good backup procedures A disaster plan, with no resources in place A ‘cold site’ disaster recovery solution A ‘split site’ or ‘warm site’ disaster recovery solution A ‘hot site’ disaster recovery solution
4/14/2015
SESSION 5 - DISASTER RECOVERY 17
STAFF SYMPOSIUM IT TRACK
No disaster plan; good backup procedures The absolute minimum companies must do – even
That way even if your hardware and software is
4/14/2015
SESSION 5 - DISASTER RECOVERY 18
STAFF SYMPOSIUM IT TRACK
Once you have a good backup and archival
This simply means you ask and answer the question,
Put your plan is written form and store a copy offsite
4/14/2015
SESSION 5 - DISASTER RECOVERY 19
STAFF SYMPOSIUM IT TRACK
A simple yet effective business backup solution, a
4/14/2015
SESSION 5 - DISASTER RECOVERY 20
STAFF SYMPOSIUM IT TRACK
If your organization is large enough, it may be feasible to house the IT
department across more than one location. In the event of a disaster to
any new equipment needed could be purchased as necessary as long as the backups were properly maintained. The advantage to this method is it eliminates the need for the major up-front costs of building a dedicated disaster center.
Also know as a ‘warm’ site As your organization will need to purchase or lease the equipment in the
warm site, this option does involve more set-up costs than a cold site, but has the advantage of being able to get your business systems up and running much faster. Even sites with multiple applications can generally be back to full operation within 24 hours.
4/14/2015
SESSION 5 - DISASTER RECOVERY 21
STAFF SYMPOSIUM IT TRACK
A hot site is a premium level of disaster recovery
In this scenario, a duplicate computer center is set
4/14/2015
SESSION 5 - DISASTER RECOVERY 22
STAFF SYMPOSIUM IT TRACK
Backup Schedule Documented Recovery Process Retention Periods Recovery Time Testing and Evidence
4/14/2015
SESSION 5 - DISASTER RECOVERY 23
STAFF SYMPOSIUM IT TRACK
If today at 5 PM I were to delete ALL the files on the network file shares,
could you
When was the last time you checked to make sure your backups were
actually working?
Trustees, ask your system managers to answer these questions and show
proof of the answers.
and recoverable if you lost everything last night.
Otherwise get it on the backup list.
4/14/2015
SESSION 5 - DISASTER RECOVERY 24
STAFF SYMPOSIUM IT TRACK
NACTT Disaster Recovery Template Backup for Dummies book
4/14/2015
SESSION 5 - DISASTER RECOVERY 25
STAFF SYMPOSIUM - IT TRACK
4/14/2015
SESSION 5 - DISASTER RECOVERY 26
STAFF SYMPOSIUM IT TRACK
Have a backup copy of my computer when it
Recover my PC in minutes after it crashes? Copy this freshly installed PC to another and another
Have access to my old PC so I can run the old
Try the new version of Windows without having to
4/14/2015
SESSION 5 - DISASTER RECOVERY 27
STAFF SYMPOSIUM IT TRACK
Have a backup server to test changes w/o messing
Get rid of the half dozen servers and associated
Have a Linux/MacOS/Windows system to mess
Run multiple Operating Systems at the same time?
4/14/2015
SESSION 5 - DISASTER RECOVERY 28
STAFF SYMPOSIUM IT TRACK
4/14/2015
Turning Hardware into Software
SESSION 5 - DISASTER RECOVERY 29
STAFF SYMPOSIUM IT TRACK
Trustee A Production Virtualization Server
2 3 S v r 2 8 S v r L i n u x W i n d
s X P
Traditional Dedicated Computer Hardware (Copy image to a Virtual Machine)
Virtual Network Virtualization Software Windows 2003 File Server Windows 2008 SQL Server CPUs Memory Disk Storage N e t w
k C a r d Physical Hardware V i r t u a l H a r d w a r e V i r t u a l M a c h i n e s
Trustee B Production Virtualization Server (Trustee A Disaster Recovery Site)
W i n d
s 2 8 S Q L S e r v e r
2003 Svr
4/14/2015
SESSION 5 - DISASTER RECOVERY 31
STAFF SYMPOSIUM IT TRACK
4/14/2015
System Administration
Application Development
Continuity of Operations
SESSION 5 - DISASTER RECOVERY 32
STAFF SYMPOSIUM IT TRACK
4/14/2015
Consolidates Hardware Eases system administration Reduce hardware costs Simplifies Backup and Recovery Continuity of Operations Cloud Computing
SESSION 5 - DISASTER RECOVERY 33
STAFF SYMPOSIUM IT TRACK
4/14/2015
Desktop Software Solutions
Virtualization Server Solutions
SESSION 5 - DISASTER RECOVERY 34
STAFF SYMPOSIUM IT TRACK
Virtual Network V i r t u a l i z a t i
S
t w a r e
Windows 2003 File Server Windows 2008 SQL Server Linux Web Server Windows XP Test Desktop C P U s Memory D i s k S t
a g e N e t w
k C a r d
P h y s i c a l H a r d w a r e V i r t u a l H a r d w a r e
Virtual Machines
V i r t u a l N e t w
k
Virtualization Software W i n d
s 2 3 F i l e S e r v e r W i n d
s 2 8 S Q L S e r v e r L i n u x W e b S e r v e r W i n d
s X P T e s t D e s k t
CPUs Memory Disk Storage Network Card
Physical Hardware Virtual Hardware
G u e s t O S
V i r t u a l M a c h i n e s Host Operating System
4/14/2015
SESSION 5 - DISASTER RECOVERY 35
STAFF SYMPOSIUM IT TRACK
4/14/2015
Windows
Mac
Multi-Platform
SESSION 5 - DISASTER RECOVERY 36
STAFF SYMPOSIUM IT TRACK
4/14/2015
VMware ESX Server Microsoft Hyper Visor High-end Server Vendors use proprietary solutions
SESSION 5 - DISASTER RECOVERY 37
STAFF SYMPOSIUM IT TRACK
4/14/2015
Virtualization Software
Hardware
Operating System Software Licenses
SESSION 5 - DISASTER RECOVERY 38
STAFF SYMPOSIUM IT TRACK
6-8 Servers
Virtualization Software
Hardware
more realistic in practice)
OS Software
Total < $12,000.00
4/14/2015
SESSION 5 - DISASTER RECOVERY 39
STAFF SYMPOSIUM IT TRACK
Application compatibility w/ Windows OS
Application compatibility with VM
Hardware compatibility with VM
4/14/2015
SESSION 5 - DISASTER RECOVERY 40
STAFF SYMPOSIUM IT TRACK
Choice affects security and performance Bridged
NAT’ed
Private Virtual Network
Host Only
4/14/2015
SESSION 5 - DISASTER RECOVERY 41