398
Networking: A Beginner's Guide
In addition to details of the backup and recovery systems, a disaster recovery plan
should also address more general factors, such as these:
What hardware and software would be needed to restore operations at a
temporary site in the event of a total loss
What the worst-case information loss would be if, for instance, the building
burned to the ground
How replacement software is obtained, and how much time and what skills
would be needed to restore computing operations
Any important software licenses or license keys that are needed and how they
would be accessed in case of a total loss
How communications are handled in the event of a disaster
How a detailed remediation plan is generated and implemented once the exact
details of the disaster are known
Access Management
An important procedure to carefully document is how the company manages access
to its various systems. This document should describe the properties of the access
management system and how the various steps are performed. One section should
describe how users are authenticated to the network generally, and to any in-scope
systems in particular, as follows:
The password policies in place, both for the network and any in-scope systems
How frequently passwords are to be changed, and whether this is enforced by
the system
How complex passwords must be, and whether this is enforced by the system
How users are instructed about the nonsystem aspects of the password policy
for which they are responsible (for example, that new users acknowledge
that they must not share their password with any other individual, what they
should do if they think their password has been compromised, and so on)
How the intruder lockout system functions when an incorrect password is tried
repeatedly
You also need to show how permissions to the various parts of the network are
approved and documented. One way to do this is to develop a form for the creation of
new users or modifications in permissions for existing users. This form should specify
which parts of the network and in-scope systems a user has access to, and it should be
approved by the person's manager. For any access to in-scope systems, usually the system
is designed so that the corporate controller approves those permissions (or formally
delegates the approval to another person). Once a new user account is created based on
the form, the IT department files it and makes it available to auditors on request.