What Is New and What Still Holds True

What Is New and What Still Holds True Courtenay Enright, CBCP March 2007

Agenda 1 What Is New and What Still Holds True 2 Current Trends in Business Continuity/Disaster Recovery 3 Security Throughout Your Entire Operation Internal Confidential – not for distribution Pandemic Solutions: Practical Application 2

New • BC/DR planning for a single, localized incident Multiple instance, multiple wave planning • The back-up/DR data center Load balancing and failover across multiple sites • Central stockpiling or hardening central facilities Facility-independent, dispersed, flexible design • Long ignored and overdue Workforce continuity and remote workforce capability Internal Confidential – not for distribution Pandemic Solutions: Practical Application 3

True • The need for private/public sector joint planning • Incident Command System strategic and tactical functionality • If you can’t measure it, you can’t mitigate it • Information is power • Increased dependence on resilient technology • Security isn’t just about protection from hackers Internal Confidential – not for distribution Pandemic Solutions: Practical Application 4

Changing Focus of BC/DR • Traditional BC/DR planning not adequate for a pandemic scenario Vice president and research fellow Ken Mc. Gee said standard BC plans apply to only geographically specific disasters, such as floods, earthquakes and localized man-made disasters. However, when a pandemic does happen, experts predict it will spread across the globe quickly and create simultaneous worldwide business disruptions. For instance, relying on a backup data center in India won't help a U. S. company stay in business. The Indians who run that backup data center will be just as sick as the company's U. S. -based employees. “Gartner: Existing Business Continuity Plans Will Fail in a Pandemic”, Search. CIO. com, November 29, 2006 • “Siloed” planning no longer sufficient The Symantec team has provided thought leadership to the NIAC Study Group on the National Critical Infrastructure for a Pandemic Event, identifying and defining critical services that must be maintained, establishing criteria and principles for critical service prioritization, and identifying critical employee groups in a pandemic. This effort resulted in a report provided to President George W. Bush, the Department of Homeland Security, and the Department of Health and Human Services in January 2007. “The Prioritization of Critical Infrastructure for a Pandemic Outbreak in the United States Working Group: Final Report and Recommendations by the Council, ” online at http: //www. dhs. gov/xlibrary/assets/niac-pandemic-wg_v 8 -011707. pdf Internal Confidential – not for distribution Pandemic Solutions: Practical Application 5

Securing Remote Operations EMEA North America Network & Power Outages Bombings Ice Storms Power Outages Terrorist Attacks Japan 6 Hurricanes Earthquake Asia Pacific 3 Hurricanes Floods Latin America Internal Confidential – not for distribution Pandemic Solutions: Practical Application 6

Floods in India Internal Confidential – not for distribution Pandemic Solutions: Practical Application 7

Immediate Geographic Region Workload Shift ¥ 7/05 Pune and Mumbai Floods Internal Confidential – not for distribution Pandemic Solutions: Practical Application 8

Confidence in a Connected World • Mir 3 in ENTERPRISE for automated emergency communications and geo-tracking • CC: Service for workflow automation and reporting and CC: Storage for storage provisioning/management • Configuration Manager to determine where apps and data sit • Net Backup for back-ups and archiving on SATA • Provisioning Manager for the provisioning – Export/import for OS/application images from production to QA for every new image; this reduces the network utilization • Volume Replicator for the replication of the data • Cluster Server and Global Cluster Option for the management of the services • Volume Manager for the mirroring and space optimized snapshots for backup snaps Internal Confidential – not for distribution – Back. Up Exec and Kvault for windows backup and archiving respectively • Titan and Apropos replicated nine ways at Tie 1 facilities for uninterrupted customer technica support • Sygate On-Demand Protection for securing unmanaged devices • Cisco CIPC software for remote telecommunications capability (voice over IP) • Citrix Go To My PC reduces VPN use • Fire. Drill to test applications without interrupting production Symantec products Pandemic Solutions: Practical Application 9

Why We Did It in the First Place Least Manual Method = Most Protection • Decreasing these costs is the biggest impact to your bottom line – 60% of 5 year total cost of ownership for IT systems are staff costs – Soft ‘costs savings’ of re-deploying staff to revenue generating activities • HA architecture provides savings comprised of a 30% improvement in server administration & 50% improvement in hardware costs • Large companies realize average cost savings of $30, 000 an hour by avoiding planned and unplanned downtime, using HA solutions • This solution tests your DR capability every time you failover to the next location • Creates flexible model for growth in emerging markets and acquisitions Clustered = Best Practice • Incorporate previous equipment investments in storage and networks • Can achieve a 20%– 30% reduction in annual total cost of IT operations by consolidating servers, decreasing administration costs • Ability to rollout repeatable HA environments quickly and effectively, improving service levels, reducing support and implementation costs • Standard methods for monitoring the health and status of the clusters • Integrated set of management tools and guidance equal improved network and application up-time. • Clustered failover and load balancing eliminates the majority percentage of shortterm production outages Source: IDC 2003 Internal Confidential – not for distribution Pandemic Solutions: Practical Application 10

Resources and Guidelines • • • Sector specific appendices and more resource URLs available in the National Infrastructure Advisory Council: The Prioritization of Critical Infrastructure for a Pandemic Outbreak in the United States Working Group Report: http: //www. dhs. gov/xlibrary/assets/niac-pandemic-wg_v 8 -011707. pdf Centers for Disease Control report offers useful guidance, including a host of recommendations for developing worker safety and business continuity plans: http: //mercerselect. com/article/20076090/t/y 2 -cj 0 z. Mz. I 1 Mi. Zs. PTQ 5 MDgz. Jm 09 NTAw. ODMm. Zj 0 z-ZD 05 NDE 2/ DHS’ Pandemic Influenza Preparedness, Response, and Recovery Guide for Critical Infrastructure and Key Resources provides more detail on strategies to protect businesses and their employees during a pandemic http: //www. pandemicflu. gov/plan/pdf/CIKRpandemic. Influenza. Guide. pdf In 2006, the newly formed Forum (sectors the Banking and Finance sector depends on) engaged the Telecommunications and Electricity sectors to explore avenues for pandemic planning coordination and cooperation. As a result, the National Communications Service (NCS), the Telecommunications sector, and FSSCC (Financial Services Sector Coordinating Council) formed a working group to explore potential “bandwidth” issues associated with the likely increase in telecommuting during a pandemic. Point of contact for the "broadband pandemic study“: Name: Peter M. Fonash, Deputy Manager, National Communications System, e-mail: Peter. Fonash@dhs. gov Additional National Communications System contact information by phone: 703 -235 -5516 and e-mail: ncsweb 1@dhs. gov and NCS web page on the DHS server: http: //www. ncs. gov/index. html Incident alerts: Recipients may share ST-/PT-ISAC information only within their own immediate organization. No further dissemination is authorized. If you have any questions about this document please contact the ISAC at 866 -st-isac 1 (866. 784. 7221) or email st-isac@surfacetransportationisac. org. Customized global alerts are also available through International SOS, the world's leading provider of medical assistance, international healthcare, security services and outsourced customer care. ISOS manages the health and safety risks facing their international travelers, expatriates, and global workforce. This includes setting up/managing operations in remote locations. Name: Ryan Clark, Regional Sales Director, DC/VA/WV, e-mail: ryan. clark@internationalsos. com Readiness checklists for family and individual preparedness are posted by the Department of Health and Human Services at http: //www. pandemicflu. gov/plan/individual/index. html#checklist MIR 3, Inc. is the technology leader of Intelligent Notification solutions for enterprise-wide communications and business continuity; streamlines the dissemination of time-urgent information to and from any communications device, with multi-language features. Name: Ray Gantney, Senior Account Executive, e-mail: ray. gantney@mir 3. com Internal Confidential – not for distribution Pandemic Solutions: Practical Application 11

What Helped Us • Seasoned CBCP resources • Using principles and tenants of Incident Command System (ICS) • Granularity of work on the Business Impact Analysis (BIA) • Leveraging technology (our own software and other products) • Partnerships with International SOS, MIR 3 and Aetna • Participation in the NIAC and other private/public sector initiatives on pandemic planning • Building a solution to be flexible for growth in emerging markets and acquisition – the next company or market becomes another contingency source in a global model and ensures continuity of workforce • Lessons learned from SARS response in Asia and Canada • Augmenting existing vehicles/programs in the company to layer pandemic budgeting horizontally instead of as a vertical initiative Internal Confidential – not for distribution Pandemic Solutions: Practical Application 12

Thank You! Courtenay Enright, Director, Global BC/DR Program courtenay_enright@symantec. com 650 -224 -6597 Richard Faille, Senior Account Manager, Consulting Serv richard_faille@symantec. com 978 -927 -1171 © 2006 Symantec Corporation. All rights reserved. THIS DOCUMENT IS PROVIDED FOR INFORMATIONAL PURPOSES ONLY AND IS NOT INTENDED AS ADVERTISING. ALL WARRANTIES RELATING TO THE INFORMATION IN THIS DOCUMENT, EITHER EXPRESS OR IMPLIED, ARE DISCLAIMED TO THE MAXIMUM EXTENT ALLOWED BY LAW. THE INFORMATION IN THIS DOCUMENT IS SUBJECT TO CHANGE WITHOUT NOTICE. Internal Confidential – not for distribution Pandemic Solutions: Practical Application 13