[56031] in North American Network Operators' Group
Re: Homeland Security Alert System
daemon@ATHENA.MIT.EDU (Martin Hannigan)
Fri Feb 21 16:27:08 2003
Date: Fri, 21 Feb 2003 16:25:32 -0500
From: Martin Hannigan <hannigan@fugawi.net>
To: Valdis.Kletnieks@vt.edu
Cc: nanog@merit.edu
In-Reply-To: <200302212032.h1LKWCCu015234@turing-police.cc.vt.edu>
Errors-To: owner-nanog-outgoing@merit.edu
On Fri, Feb 21, 2003 at 03:32:12PM -0500, Valdis.Kletnieks@vt.edu wrote:
> On Fri, 21 Feb 2003 14:41:05 EST, Martin Hannigan said:
>
> > Example: DHS sets RED level. Reaction: Move some third level
> > engineers into the SOC. Audit the DR plan if it's not on schedule
> > to be audited. Audit the backup plans if not on schedule to be
> > audited. Light the medium warm NOC to HOT NOC level.
>
> Do you buy fire extinguishers when there's no fire, or do you do it
> when the smoke alarm is already going off? Or is this the converse, where
> a leaky roof doesn't get fixed because you can't work on it on rainy days,
> and on sunny days it doesn't leak?
DR is a continous loop. It's not the kind of thing you
develop and then toss on a shelf. Right now is always a good
time to audit your DR planning, or your disaster prevention
planning.
[ SNIP ]
> If you audit your backup plan, and discover you're low on tapes to send
> off-site, what are the chances that we'll still be at RED when the tapes
> actually arrive from the vendor?
If I didn't audit the backup plan, I wouldn't discover I was low
on tapes. The state of the alert is irrelevant when related to the
DR plan. It's the event itself.
I believe there is no bad time to conduct a drill or audit
a DR plan. In fact, confusing or non-standard conditions would
be optimal for such a test or audit.
-M
