Search

In a world of interdependent economies and online transactions, a large volume of data hosted on the cyberspace a daily bases. Cyber threats and attacks are steadily increasing. Most time, these threats and attacks are targeted at service providers but service users are greatly affected by the attacks due to their vulnerability level. When disasters knockdown the infrastructures of a single service provider, it will have ripple effects on thousands of innocent service users. Therefore, service users need more than ever to prepare for major crises targeted at their service providers. To cope with this trends, every service user requires an independent business continuity plan (BCP) or disaster recovery plan (DRP) and data backup policy which falls within their cost constraints while achieving the target recovery requirements in terms of recovery time objective (RTO) and recovery point objective (RPO). The aim of this paper is to develop a model for a user-centric disaster recovery system to enable service users to independently develop their data backup policies that best suits their remote databases, and host same as a cloud service deployable on public cloud for users to subscribe to and be billed on pay-as-you-go billing model. The system developed is highly compatible with MYSQL, MSSQL and Oracle databases. A combination of Dynamic System Development Methodology (DSDM) and Object- Oriented Analysis and Design Methodology (OOADM) were used to design the system while Java Enterprise Edition (JEE) is used to develop the system. The encryption and compression mechanisms of the system were tested with various sizes of backup files ranging from 64 Kb to 20Mb and several performance metrics such as (1) Encryption time; (2) Compression size; (3) CPU clock cycles and battery power are compared and analysed with some well-known encryption and compression algorithms.

Most of modern enterprises use information infrastructure and corporate information systems to organize their businesses. Continuity of business processes, availability and integrity of data and the activity of the organization as a whole depend directly on the reliability and security of their functioning. The article deals with the issues of ensuring the sustainability of basic business processes and information security of organizations to the negative impacts of natural, man-made, economic, social nature emergencies, as well as the issue of recovery of business and the necessary level of continuity in information security during and after situations that hindered the regular functioning of the organization, taking into account the nature and extent of their impact. In the first case, the task of managing business continuity is preventing a risky event, developing and implementing preventative measures. In the second case, the task of managing business continuity is reducing the impact of negative consequences, that caused interruption of activity of organization, reducing the time it takes to replace assets, and reducing the costs related to the replacement. The evolution of approaches to ensure the continuity of the business is described. An overview of standards and other regulations, where best practices in building business continuity management systems are reflected, are done. In the context of the process model of management, the main stages of business continuity management, which consist in the sequential implementation of the closed cycle “Plan – Do – Check – Act”, namely: the processes of planning, implementation, maintenance, monitoring, analyzing and improving the performance of business continuity management system, are considered. Attention is drawn to the fact that organizations within this system must develop, document, implement and maintain security procedures and security measures to ensure the necessary level of information security continuity in the face of threats and destabilizing factors of various nature. Conclusions have been made regarding the benefits that organizations gained due to developed and implemented a business continuity management system that has measures for information security.

Current guidelines and frameworks for disaster recovery and business continuity focus on helping corporations and large enterprises. With a rising number of vendors offering cloud computing solutions, most small to medium-size businesses do not count on the minimum number of users to qualify for any tier package. Moreover, the cost of purchasing a solution that does not scale to fit the needs of a small business is a consistent issue. Our solution presents a novel framework granting medium to small-size businesses the opportunity to mitigate risk and resume activities after a disaster has taken place. Furthermore, we present several recovery alternatives using a cloud-based storage solution. The results show that an optimal recovery time objective can be achieved by allowing users to retrieve backups from any platform or device with web-browsing capabilities. Also, a high level of integrity on each client can be reached, which lowers the chances of losing data or exposing financial records to an attacker.

This paper proposes a virtual network function (VNF) placement model for service chaining that minimizes the cost of using computation resources when no failure occurs while guaranteeing recovery against any single facility node failure within the recovery time objective (RTO) defined for each service. The proposed model adaptively allocates computation resources to each service under its RTO constraint. The proposed model introduces two sharing methods of computation resources among multiple service chains. The first method allows sharing a virtual machine (VM) where a VNF is scheduled to run after a failure, which contributes to suppressing the number of VMs reserved in preparation for a failure. The second method allows sharing computation capability used for VMs, which prevents unnecessary VNF scale-up that requires additional computation resources. A simulation study verifies that the proposed model reduces the cost of using computation resources compared to comparative models.

The consequences for a company losing its data or having its IT system disrupted are severe and can impact negatively on business operations. It can also cause customer dissatisfaction and subsequent revenue loss. In a competitive global market, companies have been adopting disaster recovery (DR) strategies as an attempt to keep IT systems operational, prevent data loss, and ensure business continuity. However, there is not a single DR strategy that meets the requirements of every business (e.g., availability and cost). Besides, most of the time, these requirements are conflicting. Therefore, efficient and accurate analysis of DR strategies before its deployment is crucial to choose the best strategy that suits companies’ needs and budget. In this paper, we propose the adoption of a multiple-criteria decision-making (MCDM) method and stochastic models to evaluate and rank DR strategies for IT infrastructures. The stochastic models are used for quantitative assessing distinct DR strategies regarding five DR key-metrics: availability, downtime, Recovery Time Objective (RTO), and Recovery Point Objective (RPO), and cost. We also use an MCDM method to rank the strategies according to multiple criteria (e.g., availability maximization and costs minimization). A case study demonstrates the feasibility and usefulness of the proposed approach for finding the best DR strategies according to multiple criteria.

The ongoing miniaturization and cost reduction of electronic devices (microprocessors, sensors, batteries, and wireless communication units) have allowed the proliferation of the Internet of Things (IoT)-based applications. Many of these applications are mission-critical (e.g., healthcare and traffic road management), in the sense that the IoT system needs to take critical decisions in real-time. Hence, these IoT systems need to be designed using effective fault-tolerant techniques like disaster recovery (DR) solutions. This work proposes a Petri net-based approach for modeling and analysis of DR solutions for IoT infrastructures. The proposed models allow assessing important DR measures, such as system availability, cost, and recovery time objective. To demonstrate the feasibility of our approach, we present a case study in which a real-world healthcare IoT system is modeled and analyzed. Besides, sensitivity analysis is carried out to assess the effects of model parameters on the system availability.

With the increased snapshot operations (creation or deletion), the performance of storage system will degrade severely whether in Copy on write (COW) or Redirect on write (ROW). This paper presents a novel snapshot scheme which could use of storage resources effectively and keep the historical data accurately for SSDHDD-hybrid storage system. SSD (source volume) stores all the active data and executes read/write operations without responding to snapshot operations. In contrast, HDDs (snapshot volume) store the writing data sequentially in the form of logs and are responsible for backup and snapshot operations. In this way, the hybrid storage system can get the high throughput power via SSD even the snapshot functions are active and HDDs can keep pace with the high Input/Output operations per second (IOPS) capability of the SSD. Logs are combined and kept in a separate image volume by the controller. So, fine-grained Recovery point objective (RPO) and good Recovery time objective (RTO) can be achieved. Experiment results show that the prototype can achieve excellent I/O performance while snapshot operations are active and consume a few extra storage space.

Most of modern enterprises use information infrastructure and corporate information systems to organize their businesses. Continuity of business processes, availability and integrity of data and the activity of the organization as a whole depend directly on the reliability and security of their functioning. The article deals with the issues of ensuring the sustainability of basic business processes and information security of organizations to the negative impacts of natural, man-made, economic, social nature emergencies, as well as the issue of recovery of business and the necessary level of continuity in information security during and after situations that hindered the regular functioning of the organization, taking into account the nature and extent of their impact. In the first case, the task of managing business continuity is preventing a risky event, developing and implementing preventative measures. In the second case, the task of managing business continuity is reducing the impact of negative consequences, that caused interruption of activity of organization, reducing the time it takes to replace assets, and reducing the costs related to the replacement. The evolution of approaches to ensure the continuity of the business is described. An overview of standards and other regulations, where best practices in building business continuity management systems are reflected, are done. In the context of the process model of management, the main stages of business continuity management, which consist in the sequential implementation of the closed cycle “Plan – Do – Check – Act”, namely: the processes of planning, implementation, maintenance, monitoring, analyzing and improving the performance of business continuity management system, are considered. Attention is drawn to the fact that organizations within this system must develop, document, implement and maintain security procedures and security measures to ensure the necessary level of information security continuity in the face of threats and destabilizing factors of various nature. Conclusions have been made regarding the benefits that organizations gained due to developed and implemented a business continuity management system that has measures for information security., Переважна більшість сучасних підприємств для організації своєї діяльності використовує інформаційну інфраструктуру та корпоративні інформаційні системи. Від надійності і безпеки їх функціонування напряму залежать безперервність процесів, доступність і цілісність даних, а отже і діяльність організації в цілому. У статті розглянуто питання забезпечення стійкості основних процесів та інформаційної безпеки організацій до негативних впливів надзвичайних ситуацій природного, техногенного, економічного, соціального характеру, а також питання відновлення діяльності та необхідного рівня безперервності щодо інформаційної безпеки під час та після ситуацій, що перешкодили штатному функціонуванню організації, з урахуванням характеру та ступеня їх впливу. У першому випадку завдання управління безперервністю діяльності полягають у запобіганні ризикової події і виражаються в розробленні та впровадженні превентивних заходів. У другому випадку – у зменшенні наслідків негативних впливів, що спричинили переривання діяльності організації, скороченні часу вимушеної заміни активів і зменшенні розміру витрат, пов’язаних з цією заміною. Описано еволюцію підходів щодо забезпечення безперервності діяльності організацій. Зроблено огляд стандартів та інших нормативних документів, у яких знайшли своє відображення кращі світові практики побудови систем управління безперервністю діяльності. У контексті процесної моделі менеджменту розглянуто основні етапи управління безперервністю діяльності, які полягають у послідовній реалізації замкнутого циклу “Плануй – Виконуй – Перевіряй – Дій”, а саме: процесів планування, впровадження, підтримування, моніторингу, аналізування та поліпшення результативності побудованої системи управління безперервністю діяльності. Акцентовано увагу на тому, що організації у рамках цієї системи повинні розробити, задокументувати, реалізувати та підтримувати процедури і заходи безпеки для гарантування необхідного рівня безперервності інформаційної безпеки в умовах впливу загроз і дестабілізуючих чинників різної природи. Зроблено висновки стосовно переваг, що отримують організації завдяки розробленій та впровадженій системі управління безперервністю діяльності, у якій інтегровано заходи щодо забезпечення інформаційної безпеки.

Relational databases are the most popular database system worldwide. The occurrence of failures in these systems may produce severe consequences for the business, such as data loss, customer dissatisfaction, and subsequent revenue loss. Consequently, many organizations have adopted disaster recovery (DR) solutions as an attempt to prevent data loss and ensure business continuity. Data replication for databases is one of the most used DR solution employed to guarantee data safety and availability. However, the analysis regarding DR aspects has been less explored. Therefore, in this paper, we present an integrated model-experiment approach to evaluate replication mechanisms in relational databases for DR purposes. We performed experiments in a geo-distributed cloud environment and developed analytic models to evaluate DR key-metrics such as availability, downtime, Recovery Time Objective (RTO), and Recovery Point Objective (RPO). The results revealed that the adoption of replication mechanisms could increase the system’s availability significantly. It also revealed that the replication mechanisms can guarantee RPO and RTO within seconds.

Systems unavailability may produce severe consequences for modern business such as data loss, customer dissatisfaction, and subsequent revenue loss. Disaster recovery (DR) solutions have been adopted by many organizations as an attempt to prevent data loss and ensure business continuity. With the cloud computing expansion, different cloud providers have been offering low-cost solutions for DR purposes such as the Backup-as-a-service (BaaS) for consumers. Therefore, in this paper, we present an integrated model-experiment approach to evaluate a BaaS environment for DR purposes. We use analytic models and fault-injection experiments to evaluate DR keymetrics such as availability, downtime, Recovery Time Objective (RTO), and Recovery Point Objective (RPO) in a real-world BaaS environment. The results revealed that the environment availability can vary according to the amount of data to backed up and restored. Besides, a sensitivity analysis shows that the RTO and RPO are mainly influenced by the the mean time to recover from a disaster and the backup interval, respectively.

Disaster is an unexpected event in a system lifetime, which can be made by nature or even human errors. Disaster recovery of information technology is an area of information security for protecting data against unsatisfactory events. It involves a set of procedures and tools for returning an organization to a state of normality after an occurrence of a disastrous event. So the organizations need to have a good plan in place for disaster recovery. There are many strategies for traditional disaster recovery and also for cloud-based disaster recovery. This paper focuses on using cloud-based disaster recovery strategies instead of the traditional techniques, since the cloud-based disaster recovery has proved its efficiency in providing the continuity of services faster and in less cost than the traditional ones. The paper introduces a proposed model for virtual private disaster recovery on cloud by using two metrics, which comprise a recovery time objective and a recovery point objective. The proposed model has been evaluated by experts in the field of information technology and the results show that the model has ensured the security and business continuity issues, as well as the faster recovery of a disaster that could face an organization. The paper also highlights the cloud computing services and illustrates the most benefits of cloud-based disaster recovery.

In modern corporate environments, having a disaster recovery solution is no longer a luxury but a business necessity. The adoption of a disaster recovery solution, however, can be costly and often only affordable by large enterprises. Disaster-Recovery-as-a-Service (DRaaS) is a cloud-based solution that small and medium-sized businesses have been adopting to guarantee availability even in catastrophic situations. It offers lower acquisition and operational costs than traditional solutions. This work presents availability models for evaluating a DRaaS solution taking into account crucial disaster recovery metrics, such as downtime, costs, recovery time objective, and transaction loss. Furthermore, we performed sensitivity analysis on the DRaaS model to determine the parameters that cause the greatest impact on the system availability. Based on these analyses, disaster recovery coordinators can determine the optimum point to recover the damaged system by balancing the cost of system downtime against the cost of resources required for restoring the system. Our numerical results show the effectiveness of a DRaaS solution in terms of downtime, cost, and transition loss.

Continuation of organizations’ key processes in the aftermath of disasters plays an important role in the different businesses. The business continuity management (BCM) is a new concept which has attracted a lot of attention in the last decade and the most renowned organizations in the world use BCM as an effective precautionary approach to mitigate the consequences of disasters and making them resilient against disruptions. Alongside BCM, insuring and outsourcing are two other ways for coping with disasters. This study presents a novel framework for analyzing these three strategies (i.e. BCM, outsourcing and insuring) by which the best one can be selected according to the organization’s characteristics and relevant data. Furthermore, the study aims to elaborate on the interrelationships between the organization’s desirable continuity level in terms of recovery time objective (RTO) and recovery point objective (RPO) indicators, and the chosen approach to response disastrous situations. For this, all of the cost and benefits of each approach are considered and based on the type of organization for which a cost–benefit analysis is done. Economic factors such as the current and the future values as well as inflation rate are taken into account to select the best possible response strategy. As there is inherent uncertainty in input data, this study proposes a fuzzy based method to capture the impreciseness of data in the form of triangular fuzzy numbers. The proposed methodology is implemented on a numerical example to show its applicability.

One of the main sources for the data required to accomplish an IT Business Continuity (BC) Program is obtained through business impact analysis (BIA). The main objective of conducting BIA is to determine the criticality levels of services that are essential to keep the businessup and running. BIA is crucial for business sustainability and failing to define the criticality of the organization’s services and applications leads to improper recovery strategies. However, performing BIA in the traditional way is always associated with several challenges due the nature of business practices and processes that are changing constantly. Automating the data collection of BIA has shown many benefits in capturing the required recovery time objective (RTO) and recovery point objective (RPO) for applications. However, there are numbers of challenges that have been faced during the implementation of such automation. Our approach to conduct BIA exercise consists of seven phases starting with analyzing business need, developing questionnaire, automation implementation, workshops, data gathering, application prioritization, and management approval. This paper describes the importance and challenges of conducting BIA. It shows how an organization could overcome these challenges by automating and centralizing BIA data collection for its applications. Here we illustrate how a BIA exercise is developed and integrated into a centralized data repository for an applications portfolio called MEGA.

Data Protection is an earnest action necessary for both government and corporate authority. The continuous revolution in regarding ritualized servers that joined with raising data security necessities has become troublesome for IT relationship to enhance. From the data being insured to testand approve the recover limit of the data; recovery point objectives (RPO) and recovery time objective (RTO) have made data security periodically safer. Cloud computing is quickly converting into the engaged data security elective for some of the IT affiliations. The cloud computing requires assured data security and its necessities are met while solving or alleviating the issues related with conventional data security methods. This paper analyzes these agonizing issues and how cloud reinforcement innovation overcomes them and furthermore gives a study on different reinforcement procedures used for Cloud figuring stage with respect to this stress and their execution evaluation. So in this paper we have presented a novel algorithm named seed block algorithm. The advantages of this algorithm are that first it helps user to collect information from any remote location without any problem and second it recovers the data also in case of delete or the cloud gets destroyed

Cloud database services are used to reduce the cost of storage in information technology fields and provide other benefits such as data accessibility through internet. The single cloud is defined as a group of servers whether one or multiple data centres offered by a single provider. However, moving from single cloud to multi-clouds is reasonable and important for many reasons. The services of single clouds are still subject to outage which affects the availability of the database. In the case of disaster event, the single cloud is subject to data lost partially or fully. The single cloud is predicted to become less popular with customers due to risks of database service availability failure and the possibility of malicious insiders in the single cloud. With Disaster Recovery (DR) in cloud, resources of multiple cloud service providers can be utilized cooperatively by the DR service provider. Therefore, there is a necessity to develop a practical multi-cloud based DR framework with the aim of minimizing backup cost with respect to Recovery Time Objective (RTO) and Recovery Point Objective (RPO) in order to reduce the risk of data loss. The framework attempts to maintain the availability of data by achieving high data reliability, low backup cost, and short recovery and ensure continuity for business before, during and after the disaster incident. This paper aims at proposing a multi-cloud framework maintaining high availability of data before, during and after the disaster occurrence. Besides, ensures the continuity of the database services during and after the disaster.

Specijalistički rad opisuje razvoj i implementaciju plana kontinuiteta poslovanja za proces upravljanja incidentima. U radu je naglasak stavljen na analizu utjecaja na poslovanje tzv. BIA kao razvoju planova testiranja i verificiranja plana kontinuiteta poslovanja. Osim toga, prikazan je proces izrade plana kontinuiteta poslovanja po fazama u teorijskom dijelu. Nakon toga je prikazan proces izrade plana kontinuiteta poslovanja za stvarni proces upravljanja incidentima. Na kraju rada prikazan je praktični primjer BIA analize, strategije oporavka i aktivacije plana kontinuiteta poslovanja za proces upravljanja incidentima u slučaju pojave neželjenog događaja. The thesis describes the development and implementation of business continuity plan for the management of incidents. In this thesis, emphasis is placed on the business impact analysis also known as BIA as development plans for testing and verification of the business continuity plan. The thesis shows the process of making business continuity plan in phases in the theoretical part. The thesis shows the process of making business continuity plan for the actual process of incident management. At the end of the paper is presented a practical example of the BIA analysis, recovery strategy and activation of business continuity plan for incident management process in the case of an undesirable event.

Many organizations rely on Disaster Recovery services to ensure availability and continuity of their operations during undesired circumstances and outages. Business Impact Analysis concept enables adequate planning for business continuation as it delivers essential information on services' criticality levels and their impact on business. The advancement in communication and technology has reshaped the development of Disaster Recovery solutions over cloud that become an attractive approach and fundamental part to sustain business operations. Organizations should select the model that best balances the level of control, software configuration, maintenance, and cost. In this paper, we explore Disaster Recovery architecture in term of hardware, software, data replication, networking, and access points. Further, the paper identifies key challenges, benefits, security concerns, and protections methodologies for Disaster Recovery cloud solution. Additionally, we present our illustrative cost analysis of different type of Disaster Recovery solutions based on cost of assets, operating cost, and cost of failures.

Systems outages can have disastrous effects on businesses such as data loss, customer dissatisfaction, and subsequent revenue loss. Disaster recovery (DR) solutions have been adopted by companies to minimise the effects of these outages. However, the selection of an optimal DR solution is difficult since there does not exist a single solution that suits the requirement of every company (e.g., availability and costs). In this paper, we propose an integrated model-experiment approach to evaluate DR solutions. We perform experiments in different real-world DR solutions and propose analytic models to evaluate these solutions regarding DR key-metrics: steady-state availability, recovery time objective (RTO), recovery point objective (RPO), downtime, and costs. The results reveal that DR solutions can significantly improve availability and minimise costs. Also, a sensitivity analysis identifies the parameters that most affect the RPO and RTO of the DR adopted solutions.

In this paper, we present DDP-DR: a Data Distribution Planner for Disaster Recovery. DDP-DR provides an optimal way of backing-up critical business data into data centers (DCs) across several Geographic locations. DDP-DR provides a plan for replication of backup data across potentially large number of data centers so that (i) the client data is recoverable in the event of catastrophic failure at one or more data centers (disaster recovery) and, (ii) the client data is replicated and distributed in an optimal way taking into consideration major business criteria such as cost of storage, protection level against site failures, and other business and operational parameters like recovery point objective (RPO), and recovery time objective (RTO). The planner uses Erasure Coding (EC) to divide and codify data chunks into fragments and distribute the fragments across DR sites or storage zones so that failure of one or more site / zone can be tolerated and data can be regenerated. We describe data distribution planning approaches for both single customer and multiple customer scenarios. We describe a fault-tolerant multi-cloud data backup scheme using erasure coding.The data is distributed using a plan driven by a multi-criteria optimization.The plan uses parameters like cost, replication level, recoverability objective etc.Both single customer and multiple customer cases are tackled.Simulation results for the plans and sensitivity analyses are discussed.

IntroductionThe catastrophic Great East Japan Earthquake in 2011 created a crisis in a university-affiliated hospital by disrupting the water supply for 10 days. In response, this study was conducted to analyze water use and prioritize water consumption in each department of the hospital by applying a business impact analysis (BIA). Identifying the minimum amount of water necessary for continuing operations during a disaster was an additional goal.ProblemWater is essential for many hospital operations and disaster-ready policies must be in place for the safety and continued care of patients.MethodsA team of doctors, nurses, and office workers in the hospital devised a BIA questionnaire to examine all operations using water. The questionnaire included department name, operation name, suggested substitutes for water, and the estimated daily amount of water consumption. Operations were placed in one of three ranks (S, A, or B) depending on the impact on patients and the need for operational continuity. Recovery time objective (RTO), which is equivalent to the maximum tolerable period of disruption, was determined. Furthermore, the actual use of water and the efficiency of substitute methods, practiced during the water-disrupted periods, were verified in each operation.ResultsThere were 24 activities using water in eight departments, and the estimated water consumption in the hospital was 326 (SD = 17) m3per day: 64 (SD = 3) m3for S (20%), 167 (SD = 8) m3for A (51%), and 95 (SD = 5) m3for B operations (29%). During the disruption, the hospital had about 520 m3of available water. When the RTO was set to four days, the amount of water available would have been 130 m3per day. During the crisis, 81% of the substitute methods were used for the S and A operations.ConclusionThis is the first study to identify and prioritize hospital operations necessary for the efficient continuation of medical treatment during suspension of the water supply by applying a BIA. Understanding the priority of operations and the minimum daily water requirement for each operation is important for a hospital in the event of an unexpected adverse situation, such as a major disaster.SuginakaH,OkamotoK,HiranoY,FukumotoY,MorikawaM,OodeY,SumiY,InoueY,MatsudaS,TanakaH.Hospital disaster response using business impact analysis.Prehosp Disaster Med.2014;29(5):1-8.

Modern companies have been facing devastating impacts from unexpected events such as demand uncertainties, natural disasters, and terrorist attacks due to the increasing global supply chain complexity. This paper proposes a multi stage logistic network model under disruption risk. To formulate the problem practically, we consider the effect of continuity rate, which is defined as a percentage of ability of the facility to provide backup allocation to customers in the abnormal situation and affect the investments and operational costs. Then we vary the fixed charge for opening facilities and the operational cost according to the continuity rate. The operational level of the company decreases below the normal condition when disruption occurs. The backup source after the disrup-tion is recovered not only as soon as possible, but also as much as possible. This is a concept of the business continuity plan to reduce the recovery time objective such a continuity rate will affect the investments and op-erational costs. Through numerical experiments, we have shown the proposed idea is capable of designing a resilient logistic network available for business continuity management/plan.

Security operations focus on configuration and change management. Continuity of operations is also presented in this chapter with discussions of different methods of ensuring availability through highly available systems, redundant array of inexpensive disks, and service level agreements. A methodology and discussion about incident response is the final focus of the Operations Security domain. The second part of this chapter focuses on business continuity and disaster recovery. A thorough understanding of both business continuity planning (BCP) and disaster recovery planning (DRP) is required in order to be successful in answering questions from this domain. A key goal is to understand the differences in the scope and purpose of BCP and DRP. DRP represents a more tactical information systems focused exercise while BCP, which includes DRP as one of its components, is considerably more vast and high level. Key concepts for this domain include that of performing a business impact analysis and determining a system's maximum tolerable downtime.

A major incident affects the performance of the whole business. The key objectives are to: a. minimize the probability of an incident arising; b. reduce the impact of any potential incident; and c. shorten the period of disruption. International Standards Organization (ISO) 22399:2007, Guideline for incident preparedness and operational continuity management, is applicable to the whole Incident Preparedness and Operational Continuity Management (IPOCM) life cycle, including emergency planning. The life cycle of IPOCM implementation is: a. business impact assessment; b. response strategy; c. document and implement plan; and d. training, testing, and maintenance. The risk is effectively managed within the Enterprise Risk Management (ERM) framework and the Risk Management Process (RMP). However, should a risk materialize, the various plans come into action: emergency response, crisis management, business continuity, and IT disaster recovery. Safety cases are “a documented body of evidence that provides a convincing and valid argument that a system is adequately safe for a given application in a given environment.” Regular practice exercises with likely scenarios are necessary in anticipation of any likely eventuality. Business resilience is the ability of the company not to incur long-term damage, physically or otherwise. Mitigation includes IT disaster recovery planning and secure fireproof storage of critical documents. Key Performance Indicators (KPIs) are required to assess the performance of the IPOCM processes. Learning from mistakes (ours and others) requires an open mind and continual reinforcement. In summary, a structured approach to IPOCM has to be embedded in the way we do business, with ISO 22399:2007 as the basis of the company IPOCM.

Even though most of domestic corporations are doing various activities to reduce disasters, it is true that those are actually limited to some parts of business or the formalities in order to obtain specific certificates. For that reason, this writer study a efficient utilization of a guideline about accident provision and business continuity management for less disasters of companies, prevent interruption of critical mission. In short, it is required to operate an effective disaster recovery system and safety management system integrated by a mutual recognition on the relevant parts and different parts. And there is a need to establish a integrated recovery center in order to manage disaster recovery system realistic and effective.

The Great East Japan Earthquake hit the Tohoku district Pacific coast at March 11, 2011. This earthquake exceeded by far the earthquake scale, tsunami height, and damage size that had been assumed conventionally by a specialty committee located in Japan’s Central Disaster Prevention Council. To fill in the gap between earthquakes that had been assumed conventionally and the reality that was witnessed with their own eyes in this earthquake, trace investigations for gigantic earthquakes and tsunamis in old age are currently being carried out [18]. Under these circumstances, this paper focuses on the problem of unexpected disasters based on the viewpoint of Business Continuity Management (BCM), referring to survey results, which were immediately conducted among domestic companies after this earthquake. Characteristics of the problem of unexpected disasters are to have to solve two problems: how to assume unexpected events and the delay of “current recoverable time” that occurs as a result.

Since most of companies these days are utilizing the Information system actively, Information System is the most important factor which should be recovered in terms of Business Continuity. However, a lot of enterprises have been outsourcing their Disaster Recovery Center. Therefore, it is highly possible that the information system can not work well and result in the discontinuity of business when any trouble arises because of seperated plan of Business Continuity and Disaster Recovery. The study draws critical success factors for successful disaster recovery through researches of 42 documents. Then, factors are reviewed through interviews with consultants, experts of Business Continuity Plan and the information system officers of domestic banks. Domestic companies can make use of the study when they develop or renew Disaster Recovery Plan or Information System in terms of Business continuity.

Companies can suffer significant losses as a result of unanticipated business disruptions caused by natural disasters or outbreaks of disease. In order to restore the organization’s critical functions and minimize the impacts of a disruption, it is important to establish business continuity planning and recovery planning. First the risks in the external environment surrounding the companies and business continuity planning were described. Then, how the computer-based simulation technique could be utilized to establish the business continuity planning was examined under a pandemic environment. In this study, an approach of examining the operation rates and the plant-utilization rates was proposed for a factory, by applying simulation. The proposed approach was applied to a real manufacturer especially under a pandemic flu environment in order to confirm its effectiveness. (Received in July 2010, accepted in November 2010. This paper was with the authors 1 month for 1 revision.)

Business Continuity Planning entails the policies and procedures that ensures the continuity of the business in an enterprise in case of an unplanned outage. Disaster Recovery is a subset of Business Continuity Planning and it focusses on the continuity of Information Technology systems. Disaster Recovery Planning process involves detailed study of business processes, risk analysis, determination of disaster recovery objectives, formulation and testing of disaster recovery strategy. There are numerous parameters that influence the disaster recovery strategy. The subject of Disaster Recovery is paramount important to the business organizations. There has been no study available in the literature that could provide a detailed list of parameters across various phases of Disaster Recovery planning process that influence the Disaster Recovery Strategy. In this study, a literature survey has been conducted followed by interviews of the industry experts from an enterprise application to explore various parameters. Total eighteen parameters were identified that influence overall Disaster Recovery Strategy. Out of these eighteen parameters, four parameters are found to be new as they were not mentioned in the existing literature.

The current work aims to the development of the Business Continuity Testing Points method which can help both IT as well as business managers define an efficient business continuity strategy. The BCTP method stems from the UML Use Case Points theory which is a practically tested and accepted approach to SW complexity estimation. The Use Case Points methodology was selected as the theory behind the construction of the BCTP model, due to the fact that firstly, both theories share the requirement analysis task and secondly because complexity of information systems is strongly related to their recovery in cases of their unexpected failovers. In the Use Case Points theory IT analysts perform software requirement analysis by executing various business scenarios. The BCTP theory, on the other hand, is constructed to support the analysis of IT system recovery requirements, by executing multiple efficient recovery scenarios. The method is a new approach to the objective determination of the Recovery Time Effort of a business function in comparison to the Rational Time Objective and the Maximum Acceptable Outage, which are defined with regard to the Impact Value Level of the function. The most critical functions of the enterprise should be included in the Minimum Business Continuity Objective (MBCO) concept. MBCO refers to vital business functions without which the enterprise is not able to perform its basic operations. The Recovery Time Effort of a given business function is affected by multiple Technical, Environmental and Unexpected factors with precise weights and assessment values. Recovery exercises should be based on scenarios which include the unexpected factors that may delay the recovery process. The derived exercise results are proposed as drivers for the reassessment of the criticality of a business function.