Determine the events and environmental surroundings that can adversely affect the organization and its facilities with disruption as well as disaster, the damage such events can cause, and the controls needed to prevent or minimize the effects of potential loss. Provide cost-benefit analysis to justify investment in controls to mitigate risks. - DRI International
Information stored in the CDC business systems is critical to the continuance of StorageTek. Data such as customer information, sales information, parts and service records, forecasting, cash flow, financial actuals, and development of new products and services require a very high level of protection. Loss of past or present data would create financial and marketing chaos from which StorageTek might never recover. The threats to this data are changing and may be increasing with our reliance on technology to collect, move, and store this information.
Part of the Business Impact Analysis was to evaluate the risk exposure of business critical data. The findings can be described by the following three categories of risk:
Technological
Natural
Willful
The greatest Technological risks which StorageTek faces are failures of the underlying technology which support the systems that secure and permit access to the data. Risks to hardware, software, electrical power, and communications problems and failures are good examples of technological risks.
Fire is the Natural risk to which StorageTek is most vulnerable.
Virus attacks is also a prominent risk for StorageTek. The planting of a virus, hacking of a system and intentional destruction of a system or data source are other examples of this type of risk. Virus attacks are rated number one because "Antivirus software can only react to viruses after the fact" -- Information Week, 1999
"Melissa virus was actually pretty tame" Information Security -- May 1999
Cost of the Worm virus to StorageTek - $500,000. Worm not even top 5.
We have identified not only the major elements of risk listed above, but also the minor risks like bombs, flooding, sever storm, personnel loss and tornadoes. Protecting our backup servers, disk and tape, from the same risks as the CDC is critical.