UMUC-Europe Syllabus

IFSM 432 Disaster Recovery Planning (3) Prerequisite: IFSM 300. Recommended: IFSM 430. A study of disaster recovery and emergency planning as applied to the information-systems function in corporations. Topics include security risk evaluation and management, creation of threat profiles, continuity of operations planning, contingency planning, and incident reporting. A self-directed approach/tool for the conduct of information security risk evaluation is introduced. Projects include developing a security protection strategy and plan. Students may receive credit for only one of the following courses: IFSM 432 or IFSM 498N.

Course Goals/Objectives:

After completing this course, you should be able to: · identify, define, and apply the principles, attributes, and outputs contained within the consequence management (CM) framework (Competence in Information Technology, Information Literacy) · analyze, identify, and define the critical business process infrastructures within an organization (Effective Writing, Competence in Information Technology, Information Literacy, Civic Responsibility) · conduct an information technology vulnerability analysis and risk assessment for the purpose of improving an organization's continuity of operations posture (Competence in Information Technology, Information Literacy) · develop a contingency agreement strategy based on vulnerability and risk analyses (Effective Writing, Competence in Information Technology, Information Literacy) · create and build a prioritized recovery matrix, given knowledge of a business' critical business processes and an inventory of hardware, system software, and critical applications (Competence in Information Technology, Information Literacy, Historical Perspective) · create an organizational emergency response plan (ERP) and disaster recovery plan (DRP) including team call lists, vendor call lists, and recovery tasks for each team within an organization (Competence in Information Technology) · employ the CM planning framework to support awareness, training, testing, and maintenance of the plan (Effective Writing, Information Literacy)

Course Introduction:

Although natural disasters such as severe weather, fires, and earthquakes have threatened businesses and other public organizations for ages, planned mitigation of their effects has, for the most part, remained an afterthought in business-process development. The dawn of ubiquitous business and personal communications technology in the 1990s provided many new opportunities for expanded information services throughout business and government. However, these burgeoning networks also present additional (if largely unrecognized) disaster risks. The erratic global security environment of the new century has further amplified the fragile interdependence between business processes and their supporting information infrastructures. Modern organizations must continue leveraging the global network infrastructure to develop new business opportunities, while also dealing with the emergence of new purposeful disasters including malicious code, insider sabotage, and terrorism. Traditional measures of organizational quality such as value, customer service, and social responsibility remain valid. An organization's ability to deal with adversity while providing consistent, uninterrupted output of products and services has come to light as a new mark of excellence for customers and investors alike. Accordingly, the disaster prevention and recovery planning function has emerged as a necessary, value-producing activity in many organizations. This course will introduce the fundamental concepts common to disaster prevention and recovery planning methods, with a focus on the development of emergency response plans (ERPs) and disaster recovery plans (DRPs). Although it is simple to assume that a corporation would protect every asset from disaster, fiscal reality calls for a more carefully managed plan. Choices must be made, based on the organization's values, priorities, and financial position. Disaster recovery planners must have insight to the organization's core functions as well as intimate knowledge of myriad technical and administrative details. The practical methods developed in this course will include gathering, analyzing, and managing this information. This course will enable you to develop a framework to justify disaster prevention and recovery expenditures based on a prioritized accounting of specific organizational vulnerabilities and risks. The course establishes the ERP and DRP as parts of a broader consequence management (CM) concept, which includes business continuity, business process reconstitution, and ongoing training, testing, and assessment support for the plans. The major issues addressed in this course include the following: · evaluation and management of business impact analysis · principles and attributes of contingency planning · organizational knowledge identification · asset inventory · conducting risk analysis · developing a contingency strategy · backup strategy and requirements · continuity of operations · incident reporting and response · monitoring results/metrics · testing and ongoing maintenance

Grading Information and Criteria:

Your grade will be determined as follows: Interaction/Participation 20% Assignment 1: Identifying Key Business Processes 10% Assignment 2: Threat - Vulnerability - Risk Analysis 10% Assignment 3: The Emergency Response Plan 5% Assignment 4: The Disaster Recovery Plan 5% Annotated Bibliography 10% Final Examination 40% Total 100% The grading scale is: A= 90%-100% B= 80%-89.5% C= 70%-79.5% D= 60%-69.5% F= Below 60% Final Examination The final examination is a proctored exam administered during week 15 of the course. There are no exceptions to this policy without explicit, prearranged permission from the instructor. If you have TDY scheduled or emergency leave comes up, please contact your instructor immediately. Failing to take the mandatory proctored exam will result in an F (a) grade for the course. The exam will consist of several multiple-choice and essay questions. The course conference discussions, course modules, and assignments will serve as resources for the exam. The exam will be closed book. It counts for 40 percent of your total grade.

Other Information:

Late Policy All work and assignments must be posted in the appropriate WebTycho conference or assignment folder by the assigned date. Assignments turned in late will be penalized one letter grade per week that they are late. Extra Credit There are no extra credit assignments. Participation Distance learning courses are designed for the University student whose duties, location, time, and/or other circumstances prohibit attendance at a regularly scheduled class. You should note that more of the burden for learning falls on the student in a distance learning course. The instructor will act as a mentor and guide, but the responsibility for reviewing, organizing, and learning course materials falls predominately on the student. For those students who are self-motivated, disciplined, and enjoy learning on their own, successful completion of these courses shouldn't pose a problem. Please consider this carefully when budgeting your time. Satisfactory performance in a course like this will easily require seven to eight hours of dedicated time per week. Course Communications For a more rewarding online learning experience, frequent communication is essential. This communication involves faculty-student interaction as well as student-student interaction. There are three primary communication vehicles: e-mail, class announcements, and comments posted in conferences. You are encouraged to check the classroom conference on a regular basis for communications from faculty and classmates. Almost all class communication should take place within the WebTycho environment so that everyone can benefit from the interaction. In cases where it is more appropriate to use priv ate e-mail, please include the course number and topic in the subject line. Assignment Feedback You can expect to receive feedback on each of your assignments within two weeks following their submission. Those assignments that require instructor feedback before you can proceed to the next part of the assignment will be returned to you as promptly as possible. For other assignments, which are larger in scope, it may take longer for feedback to be returned. Rest assured, you will receive your grade and specific comments designed to help you improve subsequent assignments. The goal is to help you achieve the highest level of performance possible in this course. Writing and Research Effective writing is critical to the intellectual life of university students and graduates within the workplace. As such, your grade will reflect the quality of your writing as well as the relevance, accuracy, and forethought of your ideas. Your work in this course is expected to demonstrate your ability to master and effectively communicate the course content. For the purposes of this course, effective writing accomplishes the following goals: · meets the needs of the reader · adequately covers the subject · uses expected conventions of format and organizations · demonstrates use of credible reasoning and evidence · satisfies standards of style and grammatical correctness · requires 100% compliance with UMUC's zero-tolerance policy regarding plagiarism In addition to the writing and research requirements listed above, UMUC requires that its curriculum and class activities provide students with competence in information technology and information literacy, along with an awareness of the historical and international perspectives of learning. The class activities listed in the table below will enable you to satisfy these requirements. Cross-curricular initiatives Activity in this class that fulfills the initiative Effective Writing Thoroughly describe the key business processes of a notional organization, which will be used in completion of course assignments. Competence in Information Technology Create a Threat - Vulnerability - Risk Assessment for a notional organization. Historical Perspective Discuss the circumstances supporting the emergence of disaster prevention and recovery planning as a formal discipline. International Perspective Assignment submissions must show due consideration of issues involving international business operations, legislative policies, and personnel. Discussion topics will also support this initiative. Civic Responsibility Discussion of issues related to the legal, ethical, and public affairs aspects of disaster prevention and recovery planning. Information Literacy The annotated bibliography, course assignments, and discussion topics require the student to utilize modern research tools to locating relevant sources of information in support of their participation in the course. Conferences In this course, conferences will focus on providing information about the most current topics and giving each of you an opportunity to share your experiences, add inf ormation, and ask questions. Full intellectual engagement is essential to the success and enjoyment of your distance education experience. As an advantage over the traditional classroom, individual participation is completely documented within our online environment. Thus, the frequency and quality of your efforts are more easily reviewed and evaluated over time. Accordingly, significant emphasis (20 percent of your of total grade) is placed on this aspect of the course. There will be five conferences consisting of two to five discussion issues per week. Please note the beginning and ending dates for each conference. The most successful students participate by observing the following conventions: · address conference topics early in the week with original contributions · actively engage others in discussion of the course material and any controversial issues that may arise · reference additional interesting and relevant resources · respectfully assist others to enhance their depth of understanding

Project Descriptions:

Class Assignments There will be four class assignments designed to reinforce material presented in the text. Each assignment will build upon the previous one, providing a practical application of the subject matter across the course. Each student will also compile a supporting annotated bibliography (see below) for each assignment. After all assignments are complete and submitted in your individual Assignment Folder, you will post your composite annotated bibliographies as a useful reference for the class. The most successful students complete assignments observing the following conventions: · create moderately-detailed sample documents in a professional format using correct grammar and spelling · utilize at least five non-textbook sources in completing each assignment · weave together concepts from this course and others Annotated Bibliography Each student is required to develop and post a well-organized annotated bibliography supporting the work done for assignments 1 through 4. The document will inform the reader of the relevance, accuracy, and quality of at least 20 technical sources pertinent to the material. Sources for review should be chosen from serious technical publications other than textbooks. You are encouraged to use resources found in the UMUC's online library and database collection. A portion of the annotated bibliography containing at least five references is to be submitted with each course assignment. Following the completion of assignment 4, the full annotated bibliography shall be posted in the designated WebTycho conference area. General guidelines for preparing the annotated bibliography can be found at http://www.library.cornell.edu/okuref/research/skill28.htm

Academic Policies:

Cases of plagiarism are handled consistent with current UMUC guidelines. See the UMUC policies at the following URL: http://www.umuc.edu/policy/

Course Schedule:

Week Module Readings/Assignment(s) Due Date Week 1 Personal Intro: Provide a brief statement telling the class what you hope to get out of the courseandChapter 1: Introduction to Disaster Recovery.Assignment: Answer the 25 review questions found on pages 15-17 of the course text.Dicussion: Post your view of why having a disaster recovery plan for your organization might be necessary. Begin gathering data related to the first part of your course project - Identifying Key Business Processes. Week 2 Chapter 2: Preparing to Develop the Disaster Recovery PlanAssignment: Answer the 25 review questions found on pages 45-47 of the course text.Discussion: Post your thoughts on how important it is to have the leaders of an organization involved and supportive of a disaster recovery plan. Week 3 Chapter 3: Assessing Risks in the EnterpriseAssignment: Using the information contained in the chapter, assess the risks of an "organization" you are familiar with (your office, unit, home business, etc.). Your assessment need not be formal but ensure you identify the potential risks to the structure, personnel, business systems, and IT infrastructure. Week 4 Chapter 4: Prioritizing Systems and Functions for RecoveryAssignment: Taking the risk assessment of the organization you identified in week 3, now prioritize how you would address the risks noted using the information contained in Chapter 4. Keep in mind the four areas your should look at as described on page 108 of your text when prioritizing how you would address the risks you identified. Week 5 Chapter 5: Developing Plans and ProceduresAssignment: Refer to the Case Project found on pages 159-160. Perform the task of identifying who should be on the Disaster Response Team for Harris & Heartfield Manufacturing and why.DUE DATE for the first section of your Course Assignment - Identifying Key Business Processes - is 5/1/2005. Week 6 Chapter 6: Organizational Relationships in Disaster RecoveryAssignment: Not for turn-in. Research one company on the Internet who specializes in providing hot sites for organizations to use in restoring their computer systems and operations in a disaster. Be able to describe, if asked, the differences between a hot site and a cold site with regard to DRP. Also, this is an opportunity to get caught up. Week 7 Chapter 7: Procedures for Responding to Attacks on ComputersAssignment: Answer the review questions contained on pages 215-216 of your text. Secondly, using the Internet identify three major computer emergency/incident response teams currently operating in the United States. Prepare and submit a one paragraph summary (2-3 sentences)describing each CERT/CIRT.DUE DATE for the second section of your Course Assignment - Threat, Vulnerability, and Risk Analysis - is 5/15/2005. Week 8 REVIEW - following a detailed review of the material covered to date, each of you is to prepare a 1-2 page report summarizing key points covered to date. Emphasis should be placed on hitting the key elements covered in each chapter. We will discuss some of the points presented over the coming weeks. Week 9 Chapter 8: Developing Procedures for Special CircumstancesAssignment: Answer the review questions found on page 240 of your text.DUE DATE for the third section of your Course Assignment - The Emergency Response Plan - is 5/29/2005. Week 10 Chapter 9: Implementing Disaster Recovery PlansAssignment: Answer the review questions found on pages 260-263 of your text. Week 11 Chapter 10: Testing and RehearsalBe prepared to discuss in the conference area reasons why testing and rehearsing a disaster recovery plan are important.Assignment: Answer the review questions found on pages 285-286 of your text. Week 12 Chapter 11: Continued Assessment of Needs, Threats, and SolutionsAssignment: Answer review questions 1 thru 4 and 16 thru 18 found on pages 312-313 of your text. DUE DATE for the fourth section of your Course Assignment - The Disaster Recovery Plan - is 6/19/2005. Ensure you also submit your overall project annotated bibliography at this time as well. Week 13 Chapter 12: Living Through a DisasterThis course has shown how and why organizations and businesses should expend resources to identify and prepare of potential disasters. In the aftermath of a disaster, could organizations/ businesses use a current or past disaster to learn how to improve its disaster recovery plans for future contingencies? Discuss. Assignment: Answer the review questions found on page 338 of your text. Week 14 Open Discussion Period. This time is set aside for review of the material covered throughout the course and to provide feedback on student course projects. Week 15 FINAL EXAMS - Remember to register in accordance with UMUC policies during the exam registration period.Use this time to post questions, clarify issues presented during the course, and review the course material. Best of Luck.