This agreement will enable GDV to make available for its customers and resellers the entire suite of consulting services offered by TGCA.  The services that TGCA brings to the marketplace aim to assist companies in achieving operational excellence in the realm of business continuity, disaster recovery, and the protection of crucial data.  TGCA achieves this by making the most of budget spend while bringing a high level of value to continuity programs and resources.

“The strategic aspect of the relationship between Global Data Vault and TGCA lies in both organizations’ desire to protect our customer’s critical data and make it readily available for restore and/or recovery purposes,” says Dan Bailey, Managing Director of The Global Continuity Advisors.  “TGCA is excited to be working with Global Data Vault.  We look forward to a long and prosperous relationship.”

The Global Continuity Advisors is dedicated to bringing top-quality, cost-effective consulting services to the global marketplace.  Business continuity, disaster recovery, and data protection are crucial elements to the underlying success of any organization…small or large.  The need to protect data and make it continuously available has always been a challenge…add to that the uninterrupted availability of people and their respective core of knowledge.  TGCA is the conduit behind the ability to face and overcome these challenges.

Contact TGCA at:

Dan Bailey, MBCP, FBCI

Managing Director

The Global Continuity Advisors

Office: (972) 914-5041

www.GlobalContinuityAdvisors.com

info@GlobalContinuityAdvisors.com

Businesses need a reliable way to backup data and continue doing business from remote locations.  Multiple backup options allows customers to chose the appropriate service to best fit their needs.

Click here to listen to the full interview.

Considering the possibility of a tsunami in Hawaii yesterday, Brian Chee, Interop Net’s team lead for wireless technology, gave thought to data protection and posted this article which describes how Global Data Vault’s services allow Interop Net to maintain business operations, under any circumstance.

Global Data Vault’s software is installed onto Interop’s Virtual Machines (VM), which allow Interop to synchronize VM images across their Wide Area Network (WAN) connection, and that means Interop still has access to their servers, even when their Network Operations Center (NOC) is packed away in trucks.

What are the primary objectives of access controls?
Access control maintains and safeguards confidentiality, integrity and availability of information, systems and resources:

• Confidentiality: assures that only authorized users access or view, data and systems.
• Integrity: protects data from unauthorized or inadvertent modification.
• Availability: ensures that data and resources are readily available to authorized parties.

What are the primary concerns with access control?

CFO Concerns

• Access control is a very complicated issue due to the volume and variety of systems requiring access administration within a typical organization.
• Any user with access to sensitive information poses a risk to the confidentiality, integrity and availability of that information.
• Access must be proactively managed, based on the principle of “least privilege,” which only provides users access to the IT elements they absolutely need to perform job functions.
• Critical data must be properly classified (confidential, private, financial, etc.).
• Systems and resources providing access to that data should be identified, with established rules governing access to those systems and resources.
• The “business” owns access control and must define sensitive data and the job functions requiring access to that data. IT then executes the business’ requests.

CIO Concerns

• The business owns access control and should define what constitutes sensitive data and who needs access to that data. In most organizations, IT drives efforts to implement adequate access controls once the initial requirements are obtained from the business. In many ways, this no different than implementing a new system.
• Efforts to design access controls often focus core (typically financial or customer facing) applications and do not acknowledge sensitive information stored on file shares, non-core applications, partner systems, or test environments. All storage locations for sensitive data must be recognized.
• Defining user access based on job function requires a holistic approach that is not limited to specific systems but considers all functions that an individual performs throughout the day.
• If the volumes and locations of critical information seem overwhelming, data storage practices should be simplified and streamlined. Once roles are defined, third-party tools can assist in managing access.

CISO / IT Administrator Concerns

• While the business owns access control and defines sensitive data and access requirements, IT can drive access control efforts.
• Access control is essential and extends beyond requirements for SOX, GLBA, HIPAA, PCI and other compliance measures. Access control focuses on managing risk and ensuring that users only have access to systems, information and resources required for regular job functions.
• Access controls for sensitive information must be manageable and efficient or they will not be consistently applied.
• An effective change management process is necessary to oversee changes in access control as systems and their underlying data change over time.

What key authorization elements require consideration?
Key elements of authorization relate to sets of permissions over specific directories or files, including:

• Read (R): ability to read file contents and list directory contents.
• Write (W): ability to create, add, delete or rename files or directories.
• Execute (X): ability to run programs.

Access controls for R/W/X permissions can be managed through:

Active Directory: created by Microsoft®, Active Directory allows administrators to assign policies, deploy software and apply critical updates to an organization; Active Directory also can be used to grant access to resources on the network, such as printers, servers or specific directories on servers. Active Directory control does not extend to non-Windows operating systems, such as Unix or Linux.
Identity and Access Management Solutions: Users generally have credentials for accessing the various systems they rely upon to execute their job functions (various internal web sites, network file shares, e-mail, numerous applications, etc.). Each user with credentials across numerous systems poses risk due to the difficulty of administering access control across all of those systems.

IDM solutions, however, enable administrators to centrally manage an organizations’ user base across multiple diverse platforms and applications. This concept is often referred to as single sign-on access control. Some solutions also allow for the development of and provisioning of role-based security through the centralized solution. Therefore, Identity and Access Management solutions can dramatically simplify an organization’s efforts to control user access to sensitive functions.

What key authentication elements should you consider?
CFO Concerns
User authentication is crucial. Without it, a security system may be flawed from the start.  Authentication is typically based on something the user has (e.g., a token); something the user knows (e.g. a password); or something related to the user’s physical identity (e.g. a fingerprint).  Single-factor authentication requires only one of these elements, whereas two-factor authentication requires two of those elements.

CIO Concerns
How can I make the business case for implementing more stringent user authentication measures in a down business environment? While the cost of implementation may be high, the cost of failure – all of the consequences that accompany a security breach – may be higher. When considering security measures, try to evaluate against what your peer organizations are doing, or what your customers expect.

What access control methodologies should you consider?
Enterprise access solutions can be addressed by a number of different access control technologies, such as:

• Sound Passwords:  Passwords are weak forms of authentication and should only be used to control access to less sensitive data or in combination (two-factor) with one of the other methods listed below. Passwords should be complex (difficult to guess), require mixed alpha/numeric and mixed case characters, or use passphrases greater than 14 characters in length (Due to the methodology Windows uses to make passwords compatible with older versions of the Windows operating system, passphrases greater than 14 characters are considered more secure than alpha/numeric and mixed case passwords).
• For remote users or users accessing particularly sensitive information (customer bank account files, for example), a second mechanism for authentication should be considered, such as:

o Token: a hand-held mechanism that authenticates with an enterprise server and has two-factor authentication – something a user has (the device), and something they know (such as a personal identification number); or a security token to prove one’s identity electronically (such as when an individual trying to access a bank account must verify a security image chosen as part of the login).
o Smart Card: card with embedded integrated circuits which can process data; a strong authentication methodology for organizations using single sign-on access control.
o Encrypted Key: algorithms making information unreadable except to those possessing a key; verifies authenticity of people sending and receiving information.
o Biometric Device: personal identifier, such as a retina scan or fingerprint, to identify and authenticate a user.

How should access control be documented?
As the custodian of access control in most organizations, IT should be able to readily identify what systems and internal resources users may access. Access to critical resources and data should be attributed to job functions using role-based security. When user access requests are made, they should be made based on the user‘s job function and not on a specific resource that individual wants to access. If access granted through a role is insufficient, a request is needed to review or edit that user’s security role to properly accommodate job requirements.

How can Weaver and Tidwell help?
Weaver and Tidwell’s Risk Advisory Services practice has seasoned IT professionals who are experienced in continually identifying ways to improve your organization’s information security efforts. We provide experience and expertise for financial reporting, business operations and accounting approaches, as well as information security. We gain a comprehensive understanding of your processes and specific security needs to deliver a valuable information security assessment that protects your business.

BRIAN THOMAS, CISA, CISSP
Risk Advisory Services Partner
�
www.weaverandtidwell.com

The map below shows the reported confirmed deaths from official sources in the United States from April 1 – September 9.

Now compare that to the map below, which shows the confirmed deaths reported from informal sources within the same time frame.

The number of confirmed cases of the H1N1 virus has increased over the past couple of months.  The next map pinpoints the cases that have been confirmed and reported by official sources (such as the CDC) between April 1 and September 9.

There is a significant increase in the number of confirmed cases of Swine Flu reported from informal sources (shown below).

A side-by-side comparison of the reported findings from both official sources and informal (media) sources makes for an interesting debate.  Which map(s) are most effective in regards to:
• showing the H1N1 virus’ progress through certain geographic locations?
• broadening the number of possibilities that could interrupt a business and its operations?
• motivating businesses to create and/or revise continuity plans in order to be properly prepared?

The Centers for Disease Control (CDC) has released a guidance report which recommends actions that employers should take now to decrease the spread of seasonal flu and 2009 H1N1 flu in the workplace and to help maintain business continuity during the 2009-2010 flu season.  The document states that employers who have developed pandemic plans should revise their plans in light of the current 2009 H1N1 influenza outbreak to take into account the extent and severity of disease in their community.  CDC anticipates that more communities may be affected than were in the spring/summer 2009, and/or more severely affected reflecting wider transmission and possibly greater impact. 

Considerations of Appropriate Response Strategies:
Employers should expect to see a wide range of disease patterns across the country.  In terms of response strategies, employers with more than one business location are encouraged to provide local managers with the authority to take appropriate actions outlined in their business pandemic plan based on the condition in each locality. 

Preparedness and Response Recommendations:
The research firm Gartner notes that a true pandemic could cause absenteeism rates of 40 percent or higher for enterprises and their business partners and suppliers, resulting in severe operational disruptions. The Federation of Small Businesses said firms employing three people should expect that their entire workforce could be off for 14 days this autumn, either due to infection or from school closures and transport problems.  With this said, business continuity planners should assess their essential business functions now to determine at what threshold of absenteeism those functions would be threatened if absenteeism escalates.  Planners can then prepare to take more aggressive measures to protect continuity as absenteeism escalates toward those thresholds.

Even employers in communities that have not yet felt effects from 2009 H1N1 influenza should plan for an influenza outbreak this fall and winter, and be ready to implement strategies to protect their workforce while ensuring continuity of operations.  Employers should be aware that other emergencies such as hurricanes or other natural disasters may happen during the fall and winter, creating additional challenging problems for businesses and communities. 

Important Components of an Influenza Pandemic Plan:
Some of the key factors stated in the document are:

• Be prepared to implement multiple measures to protect workers and ensure business continuity.

• Explore whether you can establish policies and practices, such as flexible worksites and flexible work hours, when possible, to increased the physical distance among employees and between employees and other if local public health authorities recommend the use of social distancing strategies.  Ensure that you have information technology and infrastructure needed to support multiple workers who may be able to work from home.

• Identify essential business functions, essential jobs or roles, and critical elements within your supply chains required to maintain business operations.  Plan for how your business will operate if there is increasing absenteeism or these supply chains are interrupted.

• Establish a process to communicate information to workers and business partners on your 2009 H1N1 influenza response plans and latest 2009 H1N1 influenza information.

A Business Pandemic Influenza Planning Checklist is provided in order to identify important, specific activities businesses can do now to prepare for pandemic influenza.

Although having a plan for threat scenarios regarding data centers and other physical corporate facilities is important, swine flu has helped emphasize the necessity to plan for scenarios that threaten people as well.  Given the human stakes and the complexities involved in an actual pandemic, advance planning is critical to ensure a careful, thoughtful response.  Strengthening the overall readiness of a company’s workforce and response plan to remain productive during such an event is priceless.

Global Data Vault and Cloud Data are service providers addressing business continuity and data protection needs for customers in the small-to-medium business (SMB) and small-to-medium enterprise (SME) space.

This agreement will leverage the resources of the two companies in several ways. Increased redundancy of infrastructure will provide greater resilience and reliability for both companies’ customers. The location of the two companies and the six time zones of separation provide geographically diverse storage for improved security and facilitate around-the-clock monitoring of infrastructure. Additional technical depth will be valuable to both companies’ research and development efforts and will help bring cutting edge continuity solutions to market.

The security provided by solutions from Global Data Vault and Cloud Data are similar.  Both company’s services provide local or remote backup and recovery of files, emails, databases or entire servers.  Both companies offer stand-by data center based disaster recovery at affordable monthly prices. Both companies value business continuity planning and see it as essential for all organizations. And each company has made a significant investment in resilient infrastructure to drive down the cost of business continuity solutions for all customers.

Learn more about solutions available from Global Data Vault and Cloud Data and follow the development of this alliance through Global Data Vault’s  blog (here) and Cloud Data’s blog.

Residents and businesses in the Northeast can and should take appropriate actions to make sure that business operations will continue if these predictions do, in fact, occur.  Like any weather-related event, (the success of) business continuity plans will be put to the test.  Such instances make business executives start asking questions similar to, “Will my business be able to bounce back from an unplanned event?” or “how long will it take to recover my company’s data?”  Global Data Vault specializes in providing backup solutions to such dilemmas that companies face everyday.  A business continuity plan is not complete without a backup solution.