Disaster recovery risk assessment for cyberterrorism attacks

Whether cyberterrorism is a real threat is subject to ongoing debate. However, if the question were to be rephrased...

as: "Are denial-of-service (DoS) attacks (the most common form that cyberterrorist attacks would take) a viable threat?" then yes, this is something that should be addressed as part of a disaster recovery/business continuity (DR/BC) plan. This plan doesn't have to be anything fancy, but it's important to have contact information for the appropriate people at your ISPs and, if relevant, cloud service providers and application service providers (ASPs) as well.

However, it is my general opinion that while DoS and distributed DoS (DDoS) attacks are real threats, they should be categorized as a high impact/low probability threat; so, while it's important to have a plan to deal with them, they shouldn't be your biggest worry.

Instead, I'd worry about low- to medium-impact/medium- to high-probability threats, as they are the ones that can eat up resources quickly in the long run. Case in point: Small virus outbreaks, while relatively low-impact, can be highly disruptive and use up resources that could be focused on other issues. Likewise, patch management, configuration management and asset management all can be done with minimal effort, provided the organization has good change control and operational discipline. Doing this sort of planning right will free up resources to deal with more troublesome, less probable issues like DoS and DDoS attacks.

For more information:

• Read more about the potential threat of cyberwarfare.
• Check out this video in which Marcus Ranum discusses cyberwarfare.