September Information Technology Division BCP Presented By Roy Gregory IT Security Manager

September Introduction The CQU Information Technology Division (staff and data centre) was relocated from the ground floor of the Library building into a newly established “Building 19” in The CQU Information Technology Division (staff and data centre) was relocated from the ground floor of the Library building into a newly established “Building 19” in 1995.

September When did we get started?  We commenced our BCP “journey” in the second half of  The driving factors were :-  Queensland Audit Office criticism of the lack of a University-wide BCP  Queensland Government Information Standard 18 Principle 9 (of 10)

September How did we get started?  In August 2002 key ITD technical staff brainstormed an initial Risk Assessment.  14 separate (high level) risks were identified, along with potential control measures.  Our greatest exposure was an outage of key business systems of up to 6 weeks as a result of a disaster in the Building 19 data centre.  A Risk Assessment Report was subsequently created and budget items for the following year were raised to address the most urgent control measures.

September Getting assistance  Having secured limited funding, we engaged a Brisbane based consultant to:-  Ensure that the BCP process we followed would meet with QAO approval  Work with us on the BCP process for Financial Services and Student Administration  The consultant provided us with a freeware MS Access project risk management tool to use for storing and reporting on our identified risks.

September BCP documentation With guidance and assistance from the consultant, we developed and have maintained, the following documentation:- With guidance and assistance from the consultant, we developed and have maintained, the following documentation:-  Threats and Risk Assessment  BCP project overview and scope, limitations, assumptions, deliverables, risk database  Event Response Plan  Roles and responsibilities, team membership, contact details, action checklists, escalation process  Business Continuity Plan  Risk categories, treatment strategies, B19/B87 service contingency status spreadsheet

September A rude awakening! (or a blessing in disguise?)  In November 2002 an incident occurred which threw a new light on the BCP issue:-

September Not a pretty sight!

September UPS meltdown  The initial incident resulted in a 10 hour outage, followed by a few weeks of running on unclean power, and another outage of a few hours to cutover to the replacement UPS (units - two of them).  This event highlighted the vulnerability of the infrastructure in the central data centre, and a commitment was made by Senior Executive to provide funding for the establishment of a second data centre.

September The second data centre For cost and logistical reasons, it was decided that the second data centre would be located on the CQU Rockhampton campus. For cost and logistical reasons, it was decided that the second data centre would be located on the CQU Rockhampton campus. There is 700m of fibre in the ground between the 2 data centres and at least 500m distance as the crow files. There is 700m of fibre in the ground between the 2 data centres and at least 500m distance as the crow files. Building 87, or “The Bunker”, which was designed in accordance with AS2834 (Computer Accommodation) and is capable of housing 22 racks, was handed over to ITD in the middle of Building 87, or “The Bunker”, which was designed in accordance with AS2834 (Computer Accommodation) and is capable of housing 22 racks, was handed over to ITD in the middle of 2004.

September Second data centre (contd..) The facility is protected by UPS, Genset, VESDA and 2 factor entry authentication (proximity card and PIN). The facility is protected by UPS, Genset, VESDA and 2 factor entry authentication (proximity card and PIN). We have over the past 2 years progressively split infrastructure between the 2 facilities, with many services now supported in “hot standby mode”. We have over the past 2 years progressively split infrastructure between the 2 facilities, with many services now supported in “hot standby mode”. Our recovery timeframe for core business systems in the event of a disaster in the B19 data centre is currently up to 72hrs. With the deployment of HP’s StorageWorks Continuous Access EVA product later this year, that timeframe will reduce to a couple of hours! Our recovery timeframe for core business systems in the event of a disaster in the B19 data centre is currently up to 72hrs. With the deployment of HP’s StorageWorks Continuous Access EVA product later this year, that timeframe will reduce to a couple of hours!

September “The Bunker”

September Risk identification and mitigation This has been an ongoing activity, with annual reviews of the ITD risk register, and determination of budget items to address further risk mitigation measures for the following year. This has been an ongoing activity, with annual reviews of the ITD risk register, and determination of budget items to address further risk mitigation measures for the following year. When built, the main data centre (in B19) only had 3 of it’s 4 perimeter walls extend to the floor above. Earlier this year the forth wall was extended, along with replacement of the entry doors, resulting in the facility now having an official 1 hour fire rating. VESDA installation is planned for early next year. When built, the main data centre (in B19) only had 3 of it’s 4 perimeter walls extend to the floor above. Earlier this year the forth wall was extended, along with replacement of the entry doors, resulting in the facility now having an official 1 hour fire rating. VESDA installation is planned for early next year.

September Our current risk exposure

September The Australian – August 29/06 The 3 biggest threats are :- The 3 biggest threats are :-  Human error  Robust change management process  Development/test environment  System failure  Removal of single points of failure  Routine testing and maintenance of supporting infrastructure (e.g. Gensets)  Malicious software  Multi-level firewalls  IDS/IPS  NAC (A/V and patch status)  User education  Admin rights

September Ongoing issues Lack of a University-wide Business Impact Analysis Lack of a University-wide Business Impact Analysis Tech staff not keeping the BCP spreadsheet up-to-date Tech staff not keeping the BCP spreadsheet up-to-date Lack of scheduled testing of standby generators Lack of scheduled testing of standby generators Lack of rechargeable torches in suitable locations Lack of rechargeable torches in suitable locations Staff leaving combustible material in data centres Staff leaving combustible material in data centres Commitment to drilling the BCP Commitment to drilling the BCP Availability of key staff out of hours Availability of key staff out of hours 85% of MOE staff users having local admin rights 85% of MOE staff users having local admin rights