Disaster recovery risk assessment for cyberterrorism attacks

In recent days, the threat of cyberterrorism attacks seems to loom darker. In this expert response, learn whether cyberterrorism threats should be feared and how to prepare for them.

David Mortman, Dell

Data center association AFCOM says companies aren't doing enough to prepare cyberterrorism disaster recovery plans, but how can a security organization make that justification to C-level executives? On the surface, it seems like a company is much more likely to deal with a security problem because of an unpatched system or a coding error in a Web application vs. a cyberterrorism attack.

Whether cyberterrorism is a real threat is subject to ongoing debate. However, if the question were to be rephrased...

Step 2 of 2:

You forgot to provide an Email Address.

This email address doesn’t appear to be valid.

This email address is already registered. Please log in.

You have exceeded the maximum character limit.

Please provide a Corporate Email Address.
- I agree to TechTarget’s Terms of Use, Privacy Policy, and the transfer of my information to the United States for processing to provide me with relevant information as described in our Privacy Policy.
Please check the box if you want to proceed.
- I agree to my information being processed by TechTarget and its Partners to contact me via phone, email, or other means regarding information relevant to my professional interests. I may unsubscribe at any time.
Please check the box if you want to proceed.

as: "Are denial-of-service (DoS) attacks (the most common form that cyberterrorist attacks would take) a viable threat?" then yes, this is something that should be addressed as part of a disaster recovery/business continuity (DR/BC) plan. This plan doesn't have to be anything fancy, but it's important to have contact information for the appropriate people at your ISPs and, if relevant, cloud service providers and application service providers (ASPs) as well.

However, it is my general opinion that while DoS and distributed DoS (DDoS) attacks are real threats, they should be categorized as a high impact/low probability threat; so, while it's important to have a plan to deal with them, they shouldn't be your biggest worry.

Instead, I'd worry about low- to medium-impact/medium- to high-probability threats, as they are the ones that can eat up resources quickly in the long run. Case in point: Small virus outbreaks, while relatively low-impact, can be highly disruptive and use up resources that could be focused on other issues. Likewise, patch management, configuration management and asset management all can be done with minimal effort, provided the organization has good change control and operational discipline. Doing this sort of planning right will free up resources to deal with more troublesome, less probable issues like DoS and DDoS attacks.

For more information:

Read more about the potential threat of cyberwarfare.
Check out this video in which Marcus Ranum discusses cyberwarfare.

This was last published in November 2009

cyberwarfare

How to handle nation-state cyberattacks on the enterprise

cyberterrorism

IAM security heightened by cyberterrorism, nation-state attack concerns

Dig Deeper on Emerging cyberattacks and threats

cyberwarfare

How to handle nation-state cyberattacks on the enterprise

cyberterrorism

IAM security heightened by cyberterrorism, nation-state attack concerns

Related Q&A from David Mortman

HIPAA and Social Security numbers in a hospital computer network

Disaster recovery and business continuity tabletop exercises

Personally identifiable information guidelines for U.S. passport numbers