Focus: Hurricane Sandy
FUR THER INFO
For information specifically affecting the private sector
critical infrastructure, contact the National Infrastructure
Coordinating Center (NICC) by telephone at (202) 282-
9201 or by e-mail at NICC@hq.dhs.gov.
gas for their homes, and electric power.
This may not interrupt connectivity for
some computers or mobile devices in
the short term, but the lack of power will
eventually render them out of service.
What about recovery times? Compare
the recovery time of a data center with a
subscription hot site or a mirrored facility with the time it might take to replace a
bridge, pump out a tunnel, repair a road surface, or restore electric power. These non-data interruptions might take days, weeks,
months, or even years. In the interim, personnel need to have contingency plans.
Systems such as the Corporate Emergency
Access System (CEAS) ( http://ceas.com/
) are designed to permit critical personnel
to access work places during certain levels
of declared disasters. But CEAS can’t
get one across a damaged bridge or on a
subway in a flooded tunnel. Public infrastructure problems often require long-term
recovery periods.
The responsibility for public infrastructure recovery is complex. For example,
electric power utilities are responsible for
repairs to transmission and distribution
lines, generation plants, and customer service systems. Most have excellent plans
for response and recovery. They also
have excellent disaster recovery plans
and DR personnel in their IT units. They
do not, however, have responsibility for
customer-owned equipment. What’s that,
you wonder? At home, it’s the line from
the weather head outside most homes and
small businesses, where the utility company’s entrance cable meets your structure.
From that point inward to the breaker box,
the equipment is the customer’s responsibility to have inspected or repaired. If
flooding has reached the breaker box or
first floor outlets, an inspection and possibly replacement of internal wiring may
be required. The inspection and repair
requires the services of a licensed electrician in most jurisdictions. Safety requires
it as well. If customer-owned equipment is
in disrepair, power will not be restored by
the utility company.
In larger businesses, such as a shopping
mall, power is often delivered from transmis-
Structures in Seagate community (Brooklyn, N.Y.) are destroyed by Hurricane Sandy. Cleanup
continues throughout the communities while residents try to get their lives back in order. Jocelyn
Augustino/FEMA
sion lines to customer-owned substations.
These substations must be fully operational
to restore power. They are the responsibility
of the customer, not the utility company.
The same is true for natural gas service.
There is a point at which the equipment is
customer owned. Underground lines can be
damaged by earthquake activity or flooding.
In such cases, personnel may not be
able to work from home or safely report
to work. In some cases, reporting to work
might require travel when a local authority
has restricted travel during a state of emergency. When travel is restricted, workers
should not be on the roads. Most recently,
this was a serious issue when subways,
trains, and buses were out of service in the
greater New York City area.
Business continuity plans often focus
on data recovery, not on human resources
or external public infrastructure. Working
from home can be helpful, but in many
cases, employees have not used the cor-
porate VPN capability in some time. They
have difficulty logging on, especially when
they don’t have a laptop with appropriate
access/security software or they didn’t take
their company computer home. Bandwidth
is another problem. If you were to map the
residence addresses of your employees,
then list the ISP’s in their locations, you
might find that several hundred or more
people would be trying to use the same
ISP to VPN at the same time neighborhood
youth are playing online video games. It
might be difficult or slow service, if the
service is up at all following a disaster.
