Lesson 4 – IT Risk Assessment

LEVEL 1 – COMPUTING SERVICES BUILDING & CENTRAL COMPUTER ROOM

The GMO building is a single story, brick structure. GMO houses the main servers, routers & the telephone system (PABX), including Payroll and Finance servers.

There is an off-sit backup facility, currently Identified, that could replace the functions of the Central Computer Room if it is rendered inoperable by environmental or man-made disaster.

Risk Assessment

Physical/Security Risks

The server room at the GMO has a fireproof door and additional security gate.  The door  and security  gate uses a normal key/lock mechanism to secure entrance.

The server room is susceptible to possible unauthorized entry and undetected intrusion. There  is no alarm or camera, system for the server room door. However  there  is  an alarm  system at the GMO in which the server room is located.

Periodically, in the evening, security from the Mine will ensure that the building doors are secured.

 

Environmental Risks Rain

There  are no  environmental  sensing devices installed in the Computer  Room to detect water leakage.  If a leak were to occur over a weekend, personnel may not be aware of it until the following Monday. This may be possibly too late to mitigate equipment damage.

 

Flooding

The server room at stores would be the first affected by flooding due to the fact that it is the lowest building.

There are no plumbing lines located above the Computer rooms, which could burst or leak.

 

LEVEL 1 – RECOVERY PLANNING

Recovery decisions will be based on the extent of the damage to the buildings and server computing rooms. A backup computing facility does not currently exist, so if the· server computing rooms remain habitable, every  effort will be made to re-establish services in the same area.

Adequate fiber; copper cable and power must be brought into the facility in order to bring up partial services to the Mine.

If it appears that recovery of individual services will take longer than a week to restore, on a selective basis, services will be evaluated for possible out-sourcing to commercial organizations.

 

LEVEL 1 – PREVENTATIVE MEASURES

The Server rooms at GMO are the most important IT resources at the Mine. Restoring these functions will be both expensive and time consuming. The current room should be “hardened” to protect them from possible environmental and or man-made damage.

 

The following recommendations are made:

• Improve the sealing and build the server room proper with access control and Server room environmental control system.
• Protect the external building transformer and generator by protecting both with locked enclosures. Protect the fiber optic and telecom cable entry point via a physical barrier.
• Provide better physical security. Fingerprint access control.
• Establish a standby computer room at the Consort, to be use as the Disaster recovery Site
• The initial focus of this effort should e to bring enough fiber, copper and power connectivity to this area  to support a partial recovery of Mines services in the event of a disaster to the Off Site Server room

Barberton  Mines  provides  internal  and  external  phone  services  through  a  Self  maintained Exchange (PABX) telephone network used within the Mine.  Use of a PABX  saves the Mine from having to connect all of its telephone sets, separately, to the public telephone network.

In addition to telephones, fax machines, modems and many other communication devices can be connected to a PABX. For  this  reason, all such devices are generally referred to as extensions.

It can and does experience problems. Most of the problems associated with the PABX are likely to cause partial phone outages or short-term inconvenience.

These problems can normally be fixed within a few hours. There are, however, some major problems that can occur and that take longer to isolate and repair.

 

Refer to the preventative measures for Computer room (mentioned in Procedure) In-place preventative measurers include:

• Backing up PABX configuration is already been done by IT Technicians.
• Making backups of the call accounting system and data on a monthly basis.
• Additional preventative measures, to be considered, should include the following:

-Installation of a fire suppression system in the Exchange Room at each mine

 

Physical/Security Risk

Physical/Security Risks for Computer room.

The cable system may potentially be damaged by vandalism and unintentional damage. Unintentional damage is the most common physical/security risk to the cable system.

 

Environmental Risk

The cable system is subject to environmental conditions.

Over time, environmental conditions such as wind rain and fire will affect the reliability and quality of the cable system.

 

External system Risk

Fiber optic and copper pathways can and have been damaged inadvertently. When this occurs, external network serviced will be impacted until repairs are carried out.

 

PREVENTATIVE MEASURES

Hardware and software patches and upgrades are installed on a regular basis. Data backup is performed on a regular basis.

 

Additional preventative measures include:

• Review server clustering/high availability options to provide automatic fall-over and system redundancy in the event of hardware failure.

 

Physical/Security Risk- Low

If an attacker has physical access to the email servers, any and all other security measures can be bypassed. The mine email servers are located in GMO server room and a relay Server is hosted at Hetzner for external mails.

 

Internal System Risk

• Internal system risks include software viruses and spam spread either intentionally or unintentionally throughout the network; viruses in particular can render the network unusable.
• The majority of current viruses are transmitted via email.
• Viruses cause a reduction of productivity on workstations, and frequently require a technician to clean or reinstall the computer.
• Incoming spam; some estimates place unwanted email (spam) at 90% of all email traffic.  This has a significant impact on the user’s productivity. Further, spam can introduce viruses and/or spyware onto a user’s workstation.
• File systems filling up due to storage limitations; if a file system is full, no additional data can be written to it. This can cause the transfer or delivery of email to fail, information to not be logged, etc.

 

Internal System Risk

• Hardware failure, physical failure of the hardware in the server will cause downtime and may cause data corruption.
• Data compromise via web application; there are a number of different kinds of attacks on web applications such as Squirrel Mail. They can allow an attacker to run programs on the server, masquerade as the user, etc.
• System level compromise via various running services (“Remote” compromises); a flay; in any service running on a server could potentially be used to compromise the server by a remote attacker unless additional measures are taken.
• System level compromise by a local user (“Local” compromise); local users are those users that actually have an account on the server. By necessity they have additional rights above  those given to an anonymous user.
• Passwords passed in the clear; most email services transfer a user’s password in clear-text. This allows a malicious user to easily read the user’s password and then masquerade as the user to send and receive messages as that user.

 

General

The Mine uses Trac-Tech access system. This system provides access to all the plants, underground and stores building.

Loss of the access system impacts door access to all plants, underground arid stores building.

 

Risk Assessment

Physical/Security Risk

There are approximately 55 Biometric readers located at the Mine.

The Biometric readers are attached to turnstiles and are subject to possible damage and vandalism.

 

Internal System Risk

No backup access server

 

External System Risk

The access system is dependent upon the network cable system for continued operation.

 

Recovery Planning

• Depending on the scope and logistics of recovery, priority items would include: Server repair or replacement
• SQL database repair, recovery, or reinstall from backups.
• Door controller’s repair or replacement. Other end-point repair or replacement.

 

Preventative Measures

• Maintain sufficient spares.
• Backup of the SQL data is done one’s daily. These backups are included in the daily backups.

 

MAINTENANCE OF THE IT DISASTER RECOVERY PLAN

• The effectiveness of this disaster  recovery plan is impacted by changes  in the environment – that the plan  was created to protect.

 

Some major factors, which will impact the plan, are:

• New equipment, changing the software environment, staff and organizational changes, and new or changing applications.
• Annually, the Finance & Admin Manager will ensure that the document is reviewed and updated as required by a team of Computing Services personnel