IT540 Unit 4 Assignment. Diane Marxen. Kaplan University

Transcription

1 IT540 Unit 4 1 IT540 UNIT 4 ASSIGNMENT IT540 Unit 4 Assignment Diane Maren Kaplan University

2 IT540 Unit 4 2 Table of Contents Page Abstract 3 Introduction and Assumptions 4 Part 1 5 Part 2 7 Conclusion 13 References 14

3 IT540 Unit 4 3 Abstract This document represents the author s work in completion of the Unit 4 weekly assignment for class IT540. The eercise involves planning for the equipment, configuration, and security of an alternate processing site for Piel, Inc., a company which provides video animations for customers worldwide. Assumptions as to what applications are most critical to Piel were made, and decisions about the form of the alternative site and how functions were to be restored as quickly as possible were made.

4 IT540 Unit 4 4 IT540 Unit 4 Assignment Introduction and Assumptions Piel, Inc. is a small to mid-sized business which depends heavily on its computer technology. In the event of a disaster in which the main processing site is not functional, an alternate site needs to be designated. In order to proceed with the development of this site, several assumptions are being made about Piel, Inc., its normal operating environment, and the scope of the disaster. First of all, let us assume the need for use of the alternate site is not due to a widespread disaster, so employees are not directly and personally affected. The use of the alternate site is a temporary situation until normal operations are restored. Temporary could mean a few days or several months. Second, all artistic and all but a few key employees will work from home using personal computers or workstations/laptops from the main site and internet connections. At the alternative site, laptops will be used instead of workstations for the convenience, portability, and small space requirements. No customers will go to the site. Printing can be handled locally by individual employees. The alternate site itself is more than easy commuting distance away from the original site, so only key personnel required to man the site will be located there. The site will be a service bureau type facility which will provide vaulting backup services during normal operation, but upon receiving notification of the eistence of an emergency situation, will provide the contracted hardware, physical space, and internet connectivity. Other assumptions: In addition to vaulting of critical data, backups appropriate to bare metal restoration have been maintained and are available. These would include operating system

5 IT540 Unit 4 5 software, application software, and configuration information at the least. The database referred to in the description of Piel s setup is mission critical. The 20 Xeon Linu servers are part of the 3D render farm. One very important part of Piel s operation is the rendering of video animations. Normally this is handled by a 3D rendering farm consisting of 20 powerful servers. On a temporary basis, this function will be outsourced to RenderRocket. Power on demand on their processors can be purchased and accessed via the Internet from employees own workstations/laptops (RenderRocket, 2011), leaving Piel s IT staff available to support other functions. In order to minimize equipment requirements, use of 2 servers running VMware will be used. These servers will be quad core, loaded with memory and disk space, and provided with multiple NICs to allow each allocated virtual machine adequate power and resources (VMware, 2011). One machine will host , file server and the RSA server. A second will host the firewall, the SFTP server, and the web server. The router has only to segment the IP which sees the Internet from the rest of the machines. This is further enabled by the use of multiple NICs on the VM servers. A switch (a simple hub would be adequate) will coordinate the multiple NICs. PART 1 Is a firewall needed? At the alternate site, a firewall is definitely needed because the site will be connected to the internet to enable the use of and employee connections. Without a firewall, all the most critical company data would be vulnerable. While the primary site is configured with a

6 IT540 Unit 4 6 dual load-balancing firewall, the temporary site would not require the dual functionality, but it must provide same filtering, including allowing , web, and SFTP traffic. Additional VPN support must be added for employee access, and the firewall and all other security measures must follow same security policy as usual. How about remote access? As most employees will not be going to the alternate site, it will be necessary for them to connect to the network. This may be accomplished by providing a VPN solution and remote access control, such as RSA (RSA SecurID, 2011). RSA adds an additional level of authentication to the VPN scenario. For many, access to browser enabled will be sufficient, assuming their primary applications (video design) are installed locally. For those who need to be on the actual network for services such as direct database access, a terminal server can be used to allow remote control processing (University of Washington, 2006). What is the physical security provided at the hosting company? Physical security must be tailored to the location and potential threats from that environment. If the location is above the ground floor, there is little need for protection from floods (Whitman & Mattord, 2012). In a service bureau environment, there usually are employees present. Once the site is activated, access to the equipment should be limited. Door locks as a minimum should be provided, but often sign-in/out, ID cards, and electronic surveillance are part of the package. There should be temperature controls and sensors for fire and water conditions. While UPSs are epected for the equipment, it might also be good to have a fallback generator available to maintain necessary power.

7 IT540 Unit 4 7 PART 2: Piel, Inc. s mission critical and non-critical applications are: Application Critical Not Critical Comment client On individual workstations/laptops office productivity On individual workstations/laptops multimedia authoring & rendering On individual workstations/laptops database access Administrative workstations only firewall web browser On individual workstations/laptops IIS Microsoft Echange SFTP anti-virus/malware intrusion detection payroll/hr company accounting remote access Add to alternative site video animation rendering Outsourcing Table 1: Critical applications. The following equipment will be needed at alternate site: Database server HP ProLiant DL360 for eample 2 VMware servers HP ProLiant DL385 quad core processors 64GB RAM 3T Raid0 3 NICs Terminal server HP ProLiant DL 385 (Hewlett Packard, 2011). Router Cisco 3800 (Cisco, 2011). Hub Cisco-Linksys 500 (Amazon.com) 3 UPSs (APC, 2011 KVM Switch (APC, 2011). Rack LCD Console (APC, 2011). 3-5 laptop computers 1 Midsized laser printer - HP

8 IT540 Unit 4 8 In a service bureau environment, the equipment is generally installed by the service bureau personnel when an emergency is declared. Piel staff would arrive to find the necessary servers up and running, ready for installation of operating systems and applications, and restoration of data. In order to minimize the time involved in this process, it is wise to perform practice runs. Many service providers include an annual testing time as part of the standby contract. Especially when virtual servers are anticipated, it is critical to prioritize the installations so the maimum can be accomplished in the minimum time. For eample, if one process runs longer, start it early. Practice enables staff to become familiar with timing and know when operator intervention is required to continue processes and when they can be unmanned. Since critical data is also being vaulted by the same service bureau, it will be handy for restoration. But carefully ordered procedures and handy configuration information is important to efficient bringing up of the alternate site. During normal operation changes in configuration, updates to software, and changes to backup procedures, media, and/or location need to be kept current in procedures for activating the alternate site. The testing process is one method to check the completeness and accuracy of this plan, and should be used as a check to see that proper updates to the plan are actually being documented. In a service bureau environment, the equipment may or may not be in a rack. If it is, for Piel s requirements, it would look something like this:

9 Figure 1: Piel s Alternative Site Rack Diagram. IT540 Unit 4 9

10 IT540 Unit 4 10 The Network configuration will look like this: Figure 2: Network Diagram. The DNS will be handled by the ISP providing Internet connection. In a service bureau environment, this becomes less important as the power is provided as part of the contract costs. For the above network, power consumption estimates are approimately as follows:

11 IT540 Unit 4 11 Power Consumption Server X4 Monitor Router Switch KVM Disk Array Laptops X4 282W 28W 12W 3W 71W 99W 20W Table 2: Power Consumption. (Smith, 2006). A 10 megabit/second Internet access will be adequate for the alternate site, as it is for the main site. Bandwidth for , FTP, database access, file storage, and Web hosting will be about the same. By outsourcing the rendering the requirements will actually be lower, although employees may find their personal ISP connections are uncomfortably slow for sending video source files to the rendering site. The firewall will be the same software as at the main location. It will be housed on a VM server which has multiple NICs to segment it from the rest of the network. Employees will connect using Windows VPN features, RSA authentication (RSA, 2011), and Terminal Server connections (University of Washington, 2006). To make the cut-over to the alternate site go smoothly, there should be one document outlining the plan. It should contain a section for all tasks and the persons assigned to do them. Detailed timing and decision milestones should be included. It should include procedures for restoring and bringing up each application, and a method for reporting progress to management. This document must be managed tightly, kept current, and overseen by an owner who understands the risks involved (Vallampati, 2009).

12 IT540 Unit 4 12 For Piel s cutover, since the primary site is out of commission, the tasks do not involve time to ramp down, and/or run parallel, but instead require speed and efficiency. As is a high priority, it should be brought up as quickly as possible after the firewall has been installed. Fileserver and database servers would be net, with remote access servers, and then the web site. Each restoration needs a detailed list of tasks from assembling software, configuration, and backups, to installing OS and configuring, to installing software, such as MS Echange or the DBMS, and installing backup software to enable restoration. At that point, data is restored. The plan could be as simple as a spreadsheet. A plan for cut-over or hand back is essentially the same as the cut over plan, especially since the assumption is that the original site is destroyed, so new hardware would be purchased and installed first. In this case, it is important to note that the alternate site must continue to backup data to keep everything current during processing. The order or restoring might, however, be different. Since the outsourced rendering farm costs based on usage, it may be good to bring that back in-house first, followed by the web site, the file server and database, and the servers.

13 IT540 Unit 4 13 Conclusion This paper is in partial completion of a Master of Science in Information Technology degree. The specific assignment was for class IT540 Management of Information Security. Several topics involving the subject the use of an alternate processing site for business continuity were discussed.

14 IT540 Unit 4 14 References APC (2011). Products and Services. Retrieved November 15, 2011 from Cisco, (2011). Routers and Switches. Retrieved November 15, 2011 from Hewlett Packard, (2011). Small & Medium Business. Retrieved November 15, 2011 from Site/en_US/-/USD/ViewProductDetail- Start?ProductUUID=IdMQ7EN5PaYAAAEtrdpVIOG5&CatalogCategoryID=YsoQ7EN 5pXkAAAEuhnsoLTj_ RenderRocket, (2011). A Render Farm in a Cloud. Retrieved November 14, 2011 from RSA SecurID, (2011). Securing Your Future with Two-Factor Authentication. Retrieved November 14, 2011 from Smith, W. (2006). Climate Change Electricity Consumption of Common Domestic Appliances. Retrieved November 14, 2001 from University of Washington, (2006). Microsoft Windows Terminal Server. Retrieve November 14, 2011 from Vallampati, M., (2009). Anatomy of a Cutover Plan or Don t get caught dead in a go-live situation. Retrieved November 14, 2011 from

15 IT540 Unit 4 15 VMware, (2011). VMware Products. Retrieved November 14, 2011 from Whitman, M.E. and Mattord, H.J. (2012). Principles of Information Security. Boston, MA. Course Technology.