Scenario: You are an information technology (IT) intern workingfor Health Network, Inc. (Health Network), a fictitious healthservices organization headquartered in Minneapolis, Minnesota.Health Network has over 600 employees throughout the organizationand generates $500 million USD in annual revenue. The company hastwo additional locations in Portland, Oregon and Arlington,Virginia, which support a mix of corporate operations. Eachcorporate facility is located near a colocation data center, whereproduction systems are located and managed by third-party datacenter hosting vendors.
Company Products Health Network has three main products:HNetExchange, HNetPay, and HNetConnect.
HNetExchange is the primary source of revenue for the company.The service handles secure electronic medical messages thatoriginate from its customers, such as large hospitals, which arethen routed to receiving customers such as clinics.
HNetPay is a Web portal used by many of the company’sHNetExchange customers to support the management of secure paymentsand billing. The HNetPay Web portal, hosted at Health Networkproduction sites, accepts various forms of payments and interactswith credit-card processing organizations much like a Web commerceshopping cart.
HNetConnect is an online directory that lists doctors, clinics,and other medical facilities to allow Health Network customers tofind the right type of care at the right locations. It containsdoctors’ personal information, work addresses, medicalcertifications, and types of services that the doctors and clinicsoffer. Doctors are given credentials and are able to update theinformation in their profile. Health Network customers, which arethe hospitals and clinics, connect to all three of the company’sproducts using HTTPS connections. Doctors and potential patientsare able to make payments and update their profiles usingInternet-accessible HTTPS Web sites.
Information Technology InfrastructureOverview
Health Network operates in three production data centers thatprovide high availability across the company’s products. The datacenters host about 1,000 production servers, and Health Networkmaintains 650 corporate laptops and company-issued mobile devicesfor its employees. Threats Identified Upon review of the currentrisk management plan, the following threats were identified:
*) Loss of company data due to hardware being removed fromproduction systems ? Loss of company information on lost or stolencompany-owned assets, such as mobile devices and laptops
*) Loss of customers due to production outages caused by variousevents, such as natural disasters, change management, unstablesoftware, and so on
*) Internet threats due to company products being accessible onthe Internet
*) Insider threats
*) Changes in regulatory landscape that may impact operationsManagement Request
Senior management at Health Network has determined that theexisting risk management plan for the organization is out of dateand a new risk management plan must be developed. Because of theimportance of risk management to the organization, seniormanagement is committed to and supportive of the project to developa new plan. You have been assigned to develop this new plan.
Additional threats other than those described previously may bediscovered when re-evaluating the current threat landscape duringthe risk assessment phase.
The budget for this project has not been defined due to seniormanagement’s desire to react to any and all material risks that areidentified within the new plan. Given the company’s annual revenue,reasonable expectations can be determined.
Project Part 2 Task 3: DisasterRecovery Plan (DRP)
Your project on risk management, the BIA, and the BCP have beenwell received by senior management at Health Network. They now wantyou to develop a DRP in order to overcome any mishaps that mightoccur in the future. You may research and use National Institute ofStandards and Technology (NIST) templates to develop a DRP plan forthe company.
Evaluation Criteria and Rubrics (Askthese questions to yourself)
- Did I develop a DRP that could recover business operationswhile efforts are ongoing to restart pervious operations?
- Did I completely fill out the template found in theirresearch?
- Did I completely understand the DRP constructs presented inclass?
- Did I create a professional, well-developed report with propergrammar, spelling, and punctuation?
