CompTIA Security_ Deluxe Study Guide_ SY0-201 - Emmett Dulaney [215]
Cold site A cold site is a facility that isn’t immediately ready to use. The organization using it must bring along its equipment and network. A cold site may provide network capability, but this isn’t usually the case; the site provides a place for operations to resume, but it doesn’t provide the infrastructure to support those operations. Cold sites work well when an extended outage is anticipated. The major challenge is that the customer must provide all the capabilities and do all the work to get back into operation. Cold sites are usually the least expensive to put into place, but they require the most advanced planning, testing, and resources to become operational—occasionally taking up to a month to make operational.
Almost anywhere can be a cold site; if necessary, users could work out of your garage for a short time. Although this may be a practical solution, it also opens up risks that you must consider. For example, while you’re operating from your garage, will the servers be secure should someone break in?
Herein lies the problem. The likelihood that you’ll need any of these facilities is low—most organizations will never need to use these types of facilities. The costs are usually based on subscription or other contracted relationships, and it’s difficult for most organizations to justify the expense. In addition, planning, testing, and maintaining these facilities is difficult; it does little good to pay for any of these services if they don’t work and aren’t available when you need them.
One of the most important aspects of using alternative sites is documentation. To create an effective site, you must have solid documentation of what you have, what you’re using, and what you need in order to get by.
Management must view the disaster-recovery plan as an integral part of its business continuity planning (BCP). Management must also provide the resources needed to implement and maintain an alternative site after the decision has been made to contract for the facilities.
Real World Scenario
Some Protection Is Better than None—Or Is It?
You’ve been tasked with the responsibility of developing a recovery plan for your company to have in place in a critical infrastructure failure. Your CEO is concerned about the budget and doesn’t want to invest many resources in a full-blown hot site.
Several options are available to you in this situation. You need to evaluate the feasibility of a warm site, a cold site, or a reciprocal agreement with another company. The warm site and cold site options will cost less than a hot site, but they will require a great deal of work in the event of a failure. A reciprocal site may be a good alternative to both, if a suitable partner organization can be found. You may want to discuss this possibility with some of your larger vendors or other companies that may have excess computer capacity. No matter which direction you recommend, you should test and develop procedures to manage the transition from your primary site to an offsite facility.
Reinforcing Vendor Support
Software vendors and hardware vendors are necessary elements in the process of building systems and applications. The costs associated with buying preconfigured software, hardware, and services are usually less than building them yourself. Unfortunately, this makes you dependent on a vendor’s ability to stay in business.
The following sections discuss service-level agreements and code escrow. These agreements help you protect yourself in the event that a software vendor goes out of business or you have a dispute with a maintenance provider for your systems.
Service-Level Agreements
A service-level agreement (SLA) is an agreement between you or your company and a service provider, typically a technical support provider. SLAs are also usually part of network availability and other agreements. They stipulate the performance you can