---

How to Justify
Security Spending

ISO Domains & Security
Manual Template

Top 10 Security Myths

Top Network
Security Weaknesses

Steps to Detect and
Prevent Security Breaches

Insider Data Security Issues

What is HIPAA

Digital Copier Risk

 

Security Manual Template

ISO 27000 / HIPAA / SOX / CobiT Compliant

Includes PCI DSS Audit Program

Updated May 2010

This Security Manual for the Internet and Information Technology is over 230 pages in length. All versions of the Security Manual template include both the Business & IT Impact Questionnaire and the Threat & Vulnerability Assessment Tool (both were redesigned to address Sarbanes Oxley compliance).   In addition, the Security Manual Template PREMIUM Edition  contains 16 detail job descriptions that apply specifically to security and Sarbanes Oxley, ISO security domains, ISO 27000 (ISO27001 and ISO27002), PCI-DSS, HIPAA, and CobiT.

Data Security and Protection are a priority and this template is a must have tool that every CIO and IT department must have. Over 3,000 enterprise worldwide have acquired this tool and it is viewed by many as the Industry Standard for Security Management and Compliance.

Comprehensive, Detailed and Customizable for Your Business

The IT Security Manual Template provides all the essential sections of a complete security manual and walks you through the creation of each step. Detailed language addressing more than a dozen security topics is included in a 230 plus page Microsoft Word document, which you can modify as much or as little as you need to fit your business requirements. The template includes sections on critical topics like:

• Risk analysis
• Staff member roles
• Physical security
• Electronic Communication (email / Smartphones)
• Blogs and Personal Web Sites
• Facility design, construction and operations
• Media and documentation
• Data and software security
• Network security
• Internet and IT contingency planning
• Insurance
• Outsourced services
• Waiver procedures
• Employee Termination Procedures and Forms
• Incident reporting procedures
• Access control guidelines
• PCI DSS Audit Program as a separate document
• Security Compliance Checklists
• Massachusetts 201 CMR 17 Compliance Checklist

The Security Manual Template can be acquired as a stand alone item (Standard) or in the Premium or Gold sets:

 

 

 

 

 

 

 

Security and Compliance News

---

Business process contingency plan is disaster recovery plan

A disaster recovery plan (DRP) - sometimes referred to as a business continuity  plan (BCP) or business process contingency plan (BPCP) - describes how an organization is to deal with potential disasters. Just as a disaster is an event that makes the continuation of normal functions impossible, a disaster recovery plan consists of the precautions taken so that the effects of a disaster will be minimized and the organization will be able to either maintain or quickly resume mission-critical functions. Typically, disaster recovery planning involves an analysis of business processes and continuity needs; it may also include a significant focus on disaster prevention. - more info

---

Disasters can occur any where at any time

Disasters are unpredictable by nature and can strike anywhere at anytime with little or no warning. Recovering from one is expensive and time consuming, particularly for those who have not taken the time to think ahead and prepare for such possibilities.

Disaster Planning - Janco has found that 80% of all enterprises that do not have a disaster recovery / business continuity plan in place before a disaster occurs never reopen.  However, when disaster strikes, those who have prepared and made recovery plans survive with comparatively minimal loss and/or disruption of productivity.

Disasters can take several different forms. Some primarily impact individuals -- e.g., hard drive meltdowns -- while others have a larger, collective impact. Disasters can occur such as power outages, floods, fires, storms, equipment failure, sabotage, terrorism, or even epidemic illness. Each of these can at the very least cause short-term disruptions in normal business operation. But recovering from the impact of many of the aforementioned disasters can take much longer, especially if organizations have not made preparations in advance.

Most of us recognize that these potential problems as possibilities. Unfortunately the randomness of some of these disasters lulls some organizations into a sense of false security-"that's not likely to happen here." However, if proper preparations have been made, the disaster recovery process does not have to be exceedingly stressful. Instead the process can be streamlined, but this facilitation of recovery will only happen where preparations have been made. Organizations that take the time to implement disaster recovery plans ahead of time often ride out catastrophes with minimal or no loss of data, hardware, or business revenue. This in turn allows them to maintain the faith and confidence of their customers and investors.

Disaster Recovery Planning is the factor that makes the critical difference between the organizations that can successfully manage crises with minimal cost and effort and maximum speed, and those that are left picking up the pieces for untold lengths of time and at whatever cost providers decide to charge; organizations forced to make decision out of desperation.

- more info

---

Disaster Plan Common Failures

Disaster Recovery Business Continuity - Common Failures 

Most common mistakes made in Disaster Recovery and Business Continuity Planning are eliminated by implementing the Janco Disaster Recovery and Business Continuity Template.  Problems that are avoided are:

- more info

---

A disaster occurs -- now what?

A disaster or business interruption occurs, what do you do?  A quick roadmap to follow is:

• Do not panic and remain calm! When a disaster or business interruption occurs the first priority number is to ensure the safety of the employees.
• Evaluate the disaster!  Determine the impact on your personnel and enterprise operations, this evaluation the event is critical in making the decision to activate the disaster recovery business continuity procedures.
• Communicate with everyone that can be impacted! Communicate with your team, managers, affiliates, and vendors frequently. Even if there is no status to report, do not leave anyone guessing or letting them draw their own conclusions.
• Know the disaster recovery business continuity plan! Testing the Business Continuity Plan regularly helps everyone in becoming familiar with what will happen and how it will be done.
• Be decisive! Once you have determined the level of disaster and everyone is safe to operate, it is time to make the decision if you need to implement the business continuity procedures or if the downtime for recovery acceptable.
• Start the process! Start with recovering the most business critical systems first to restore business operations to a functional level. There should not be any question, which order which applications need to be restored first.
• Lock down all backups and critical documentation! The first step to the recovery is having a set of data to recover from. This could be anything from archived tape, local disk copy, and a co-location or disaster recovery data center.
• Use multiple solution paths! Assume that nothing will work and have alternatives in place  
• Reactivate normal operations! Once the systems are operational, the disaster is over and systems are repaired it is time to move the workloads back to where they were originally.

- more info

---

Next Disaster Requires Culture of Preparedness

At the center of the recent White House report "Hurricane Katrina: Lessons Learned," there is a call to "foster a new, robust culture of preparedness."

The challenge comes after the report details the long list of tragedies that last year's deadly hurricane wrought, including more than 1,330 deaths and $96 billion in property damage. In terms of communications, 38 centers that normally handled 911 calls failed, while 3 million customers lost phone service.

The report urges a wide variety of players to build this new culture, including myriad federal agencies and tens of thousands of state and local emergency first responder agencies. And it calls on private citizens and the private sector to take part.

- more info

---

Regulatory compliance impacts disaster planning process

Increasing regulatory oversight: as a result of recent natural disasters, man made disasters (Gulf oil spill), and acts of terrorism (the attempted Time Square bombing)), industry and governmental regulations concerning the distance between disaster recovery sites and redundancy levels continue to tighten. In addition, highprofile customer data security breaches have led to calls for stricter regulatory compliance controls across industries (Sarbanes-Oxley, HIPAA, PCI DSS, and European Union Privacy laws). - more info

---

Improve your RTO and RPO

How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this question. Download this outline learn how the Janco Disaster Recovery Business Continuity Template can reduce RPOs and RTOs even more. 

Disaster Recovery Guide
Business Continuity Planning

ISO 27001, ISO 27002, ISO 17799, Sarbanes-Oxley, and HIPAA Compliant

         

What is Disaster Recovery and how does the Disaster Recovery Planning Template help?

This DRP Template can be used for any sized enterprise.  

The template and supporting material have been updated to be Sarbanes-Oxley compliant.  The complete package includes:

• Disaster Recovery Planning and Business Continuity Template
• Business and IT Impact Analysis Questionnaire
• Work Plan
• Disaster Recovery / Business Continuity Audit Program

With lost data being a competitive liability, there is no room for downtime in today's business world.

- more info

---

Disadvantages of tape as backup media

Tape is used for backup and archive because it is very inexpensive, but it is an old technology that has been available almost since the dawn of computing. There are several issues with tape-based backup:

 

• Tape-based backup is a time-intensive process that is potentially disruptive to your applications; this issue is commonly referred to as the backup window problem.
• Because of its impact on applications and resources, tape-based backups are usually not performed more than once a day, and often only once every several days, meaning that
  there are very few tape-based recovery points available for use over the course of a week.
• Because your data is changing very frequently (on the order of seconds or minutes), fewer recovery points mean you are risking the loss of large amounts of current data for a given recovery.
• Once it is clear that a recovery needs to occur, it takes time to perform recovery tasks including locating the correct tape, transporting it (if it's offsite), restoring it to disk and restarting the application with the recovered data.
• As a storage media for backup, tape is not entirely reliable; in fact, leading analyst groups state that as many as 1 in 4 backup tapes suffer from some sort of problem that precludes performing a recovery

- more info

---

The Difference Between Disaster Recovery Planning and Business Continuity Planning Defined

Disaster Recovery Planning (DRP) is the process by which you resume business after a disruptive event.  This typically means that you can get the enterprise computers, networks, and data base operational. The event might be something huge-like an earthquake or the terrorist attacks on the World Trade Center-or something small, like malfunctioning software caused by a computer virus.

Given the human tendency to look on the bright side, many business executives are prone to ignoring "disaster recovery" because disaster seems an unlikely event. However Janco has found that over one third of all enterprises have had to activate their Disaster Plans in the last few years.

Business Continuity Planning (BCP) suggests a more comprehensive approach to making sure you can keep the enterprise going and meet it business objectives. This goes beyond the enterprise computers, networks and data bases.  However, the two terms are married under the acronym DR/BC or DRP/BCP. At any rate, Disaster Recovery Planning and/or Business Continuity Planning facilitate how a company will keep functioning after a disruptive event until its normal facilities are restored. 

- more info

---

Network Disaster Recovery and Business Continuity CIO's Concern

In addition to the lack of a consoli­dated disaster recovery / business continuity plan  for the network management system, network operations are plagued by other problems:

• Network recovery plans are impacted by unanticipated traffic growth, configuration issues; link overloads due to traffic rerouted around failed network elements, and more.
• Changes may lead to undocumented side effects, so understanding the impact of changes before making them is essential for reliable network operations.
• The monotonous work of making simple changes to hundreds or thousands of devices or objects is error prone and often difficult to reproduce in the recovery mode.

To add to the pressure, network operations teams are expected to run larger networks that have become many times more important to the business, and to do so with fewer staff members. These con­ditions exacerbate the problems associated with disparate disaster recovery and business continuity plans.

 

- more info

---

Cloud Recovery Not Easy - Disaster Recovery Not Under User Control

Microsoft officials still have not provided many details about what caused the outage, other than to say it was a core system failure. The failure is unrelated to Microsoft's cloud infrastructure and/or Microsoft's Azure datacenters, as the company has continued to run the Sidekick back-end on the same infrastructure it has been running on before Microsoft acquired the company in 2008.

The Microsoft/Danger team apologized for the amount of time they are taking to restore contacts, photos, e-mail and other Sidekick services to which users lost access at the start of the month. The team said they were taking their time "to make sure we are doing everything possible to maintain the integrity of your data."

The team still is not committing to an exact recovery timetable, but is saying restoration should begin this week. Microsoft said, "We continue to make steady progress, and we hope to be able to begin restoring personal contacts for affected users this week, with the remainder of the content (photographs, notes, to-do-lists, marketplace data, and high scores) shortly thereafter."

After telling users that they likely had lost all of their personal data, the Microsoft/Danger team then said they expected to be able to recover some of their data. Mid-weeklast week, they said they expected to recover "most if not all" of the missing user data.

What is a Disaster Recovery and Business Continuity Plan

Disaster recovery and business continuity planning are processes that help organizations prepare for disruptive events - whether those event might include a hurricane or simply a power outage caused by a backhoe in the parking lot. The CIO's involvement in this process can range from overseeing the plan, to providing input and support, to putting the plan into action during an emergency.

- more info

---

Backup strategies developments defined

Disaster recovery and business continuity solutions that combine the latest advancements in disk-based backup with secure, integrated online technologies offer businesses fast and assured recovery of their critical business data while freeing limited technical staff for more value-driven tasks. They also reduce the burden of removing the data and storing it safely off-site, protecting it from local disasters.

The top reasons businesses are turning to this technology:

• Comprehensive and reliable data protection assures up-to-date recovery of all critical business data, including the backup of data in open files
• Automatic and secure off-site electronic vaulting guarantees successful disaster recovery
• Better control over restoring data gives businesses access to data when and where it’s needed - for any reason
• Improved security for all sensitive data ensures protection during backup, transmission and storage
• A complete data protection solution addresses the entire data protection workflow and provides a higher level of reliability, productivity and cost containment
• Immediate data restoration either over the Internet or from on-site rapid recovery appliances reduces downtime costs
• Enhanced ability to demonstrate compliance with regulations around information protection is enhanced through consistent, repeatable processes and controls
• Freedom from routine backup and restore tasks allows redirection of staff time to value-driven projects with greater impact on productivity and profitability
• Increased competitive advantage is promoted through improved access to data, more predictable cost control and flexible solutions that change with the business
• Greater reliability in recovering all data where and when needed is ensured, with successful data recovery guaranteed in writing

- more info

---

DRP Backup Solutions

To plan your data protection solution appropriately, you must first understand the type of technology environment that you are running. Consider the following:

• Direct attached storage (DAS): The simplest backup and restore environment, DAS usually consists of a standalone tape drive or an autoloader attached directly to the server that it is protecting. Businesses that operate DAS usually require backups only daily and/or weekly, maintain only a few (one or two) networked servers on each network and do not use online business-critical operations.
• Network backup: LAN/SAN-based backup storage uses devices that are managed centrally from a single console through a single backup server, reducing hardware costs, and management time. Businesses that operate LAN/SAN-based backup usually require continuous, business-critical operations as well as hourly or daily backups; have multiple networked servers; and can run multiple operating systems.

- more info

---

Disaster planning, emergency preparedness, or business continuity

Disaster planning, emergency preparedness, or business continuity (and experts note that there are differences) -  the goals are ultimately the same:  to get an organization back up and running in the event of an interruption.  The problem causing the interruption could be one computer crashing or an entire network crashing.  Or it could be an electrical outage or the result of a terrorist activity.  The goal is to have some contingency plans in the event of a problem.  A disaster recovery plan exists to preserve the organization so that it can continue to offer its services. 

 

A disaster recovery plan is a users' guide - the documentation - for how to preserve an organization.  In order for a plan to be useful, it must be created before an interruption occurs.  Business continuity is disaster recovery.  Lost revenue is a driving force in business continuity.  The reason to do a recovery plan is essentially to keep the funding coming in and the services going, and the clients being served.

 

• Emergency planning are those procedures and steps done immediately after an interruption to business.
• Disaster recovery are the steps taken to restore some functions so that some level of services can be offered.
• Business continuity is restoration planning, completing the full circle to get your organization back to where it was before an interruption.

In order to write your plan, you have to do some planning. This planning is the process that will get you to the step where you then commit your plan to paper - you can’t write a plan until you do the preparation.  The most difficult thing is getting started; the second most difficult task is keeping the plan current.

- more info

---

Disaster Planning for international enterprises

Disaster recovery and business continutiy plans for internationaly base organizations need to take in to account limitiations that various counties place on location of data.

Many parts of Europe forbid some data from being transmitted or stored outside of the country. Canada also has some rules that prohibit some data being stored in the United States due to the U.S. Patriot Act's provisions that let the federal government examine corporate records.

It's important to note that the legal issues are local to where your customer resides. You have to understand the laws and make sure that personally identifiable data and some financial records are kept local if required by the law.

This could be an issue as cloud computing systems become more distributed. Indeed, while the primary facility may be in-country, the failover site, or perhaps the site used when the primary site is under maintenance, could be across the border and, thus, noncompliant.

- more info

---

Disater Plan Manual - CIO and CSO conflict

When the task of disaster recovery planning (DRP) is dropped in the laps of information security managers and IT staff, DRP becomes a security problem.  If the disaster plan is  handed off to an organization's information security officer or IT director with little or no support, the result is usually either a set of a few policies and procedures without a solid foundation in risk assessment, or a long-winded document that overreaches and focuses on the wrong issues.

When this happens, the disaster recovery plan often does more harm than good. Thinking that disaster recovery is assured by a novice's tape backup rotation plan and off-site storage in a cabinet down the hall could lead to overconfidence, false statements during audits or contract negotiations, or even encourage risky data, network, and service management behavior. Mixing up a data, recovery procedure for a full-blown plan or inflated data-focused plan into a management policy and standards is dangerous stuff for the livelihood of a business.

Worse, there is the possibility that minimal action on the part of the CIO and IT to protect information assets will cause senior management to cool its support for enterprise risk management, disaster recovery and business continuity. Organizations making the transition from small to medium size occasionally check disaster recovery off the list when they have information asset-preservation policies, and neglect to scale up disaster response decisions and processes where they concern human safety.

- more info

---

A network outage is a disaster

A network outage is a business interuption and a disaster for most enterprise.  The disaster recovery planning process needs to consider this as one of the most likely events to occur.

 

 As businesses rely more heavily on the internet to transact business and link together branch offices, remote workers, customers and business partners, the WAN connection becomes more important than ever. A single pipe may be a company's only link to the outside world. If this pipe goes down, crucial networking functions come to a crashing halt. Although most business lines are reliable, outages are not very common. A software company that has over 25 branch offices, each with a T-1, in several 3^rd world locations has frequent outages.  About once a month, they have a T-1 outage in one of the offices, lasting from 4 to 20 hours. During that time, that remote office is effectively cut-off.  Without the WAN line, you cannot make phone calls, get e-mails or do any kind of electronic transaction. They are unable to communicate with the outside world and effectively dead in the water.

- more info

---

Backup and Backup Retention Policy Key to DRP

With companies storing data for longer periods of time to meet compliance regulations and business best practices, the inherent risk of a data breach is growing significantly. When it comes to data management, today's enterprises must balance a number of divergent requirements that often compete for priority. Many organizations routinely store backup tapes off site to meet operational requirements and business continuity objectives. However, backup tapes can easily be lost during transport, and remote storage facilities may lack adequate security. Backup and archival solutions are designed only to preserve data; they don't protect against unauthorized access. Only data encryption can effectively safeguard sensitive data by rendering it unreadable without access to the encryption key. - more info

---

Microsoft sites crash

Ongoing problems with a Microsoft Corp. Web site handling software licenses have left some business customers unable to activate and use their Microsoft apps for more than a month.

Microsoft first took down its Volume Licensing Service Center for maintenance in early December, after attempts to merge multiple licensing sites into a single, more secure site backfired for some users.

Those affected include businesses purchasing Microsoft software, or resellers and integrators handling newly-purchased software for business customers. Problems they have reported via Twitter include users losing access to paid-for software licenses; an inability to login to the VLSC site and fix this for one month or more; and six-hour waits on Microsoft telephone support trying to fix their accounts;

One user said that Microsoft, unable to grant him access to his account and license activation keys, was forced to physically mail him replacement software.

- more info

---

Tape Backups Difficult to Coordinate

According to the U.S. Labor Department, more than 40 percent of all companies that experience a disaster never reopen - and more than 25 percent of those that do reopen after a disaster occurs will close down for good within two years.

Yet many midsized companies find it difficult to regularly and effectively back up data. The traditional tape backup process is manual and time consuming: data is preserved by taking "snapshots" of server activity, which are then placed on tape for archiving. To make matters more complicated, effective manual backups typically become more difficult to achieve as data spreads across multiple systems and servers.

- more info

---

Most data disasters are caused by human error

CIOs should be aware of the fact that human error is often the main factor responsible for data disasters. Janco Associates now attribute the increase in human error incidents to complex storage systems such as multiple RAID systems on the same computer coupled with older equipment, reduced budgets, lower staffing levels, and poorly trained IT staff.

With advanced storage options such as virtualization and cloud computing offering corporations storage optimization, human processes are still conrolling factors as individuals must direct the technology as to how to operate. The complexity of these systems require a steep learning curve, and with reported IT spending at a low (down 6.9 percent in 2009 according to some research firms.), human error is increasingly more common.

Typical human caused data disaster are:

• Pulling the wrong drive. While trying to replace a failed disk in a RAID array, a healthy disk is accidently removed.
• Reformatting a disk. During a server migration, the wrong SAN LUN is accidently reformatted.
• Restoring corrupt/old backup data. A server containing a business-critical database is deleted by mistake and is restored with a corrupt or incomplete backup prior to realizing the backup is not sound.
• Rebuilding a bad array. Following a multiple drive failure in a RAID array, an attempt to force the failed drives back online and rebuild the configuration is made, whereby damaging or corrupting the data on the array.
• Deleting data. Files, volumes, virtual machines or a SAN LUN is deleted by accident and there is no backup or the backup is old or corrupt.

- more info

---

H1N1 spurs demand for disaster recovery and business continuity tools

The H1N1 pandemic is pushing companies to upgrade their secure remote access capabilities in order to enable more employees to work out of their homes and other remote locations in an emergency.

Vendors of remote access technologies are reporting an unexpected increase in demand for their products over the past several months as a result of H1N1-related concerns.

"Companies are really looking for is the ability to provide secure, remote access to more of their employees," said Victor Janulaitis, CEO Janco Associates, a provider of Disaster Recovery and Business Continuity Tools. "Most companies have extensive mobile workforces. What they are doing is planning for an ever increaseing scale," he said.

According to data collected by Janco, much of the increased interest has come from larger enterprises. These are the enterprises that seem to be more aware of the need for planning.

Security policies and procedures such as those offered by Janc  provide teleworkers with rules on how to secure access to enterprise applications from any location, using a broad range of devices. They enable IT administrators to enforce security and information usage policies.

- more info

---

Business continuity planning for a Pandemic

Larger corporations typically can continue business as usual even while many employees are out sick in a Pandemic.  However Business Continuity Planning  at small firms rely heavily on key individuals and find themselves nearly incapacitated if several of those key people get sick, must stay home with sick children, or are in areas put under quarantine.

 

• Phone Trees

At a minimum, small business owners should update employees' contact information to include current home phone numbers and addresses, e-mail addresses, and cell phone numbers. Some employers establish phone trees so they can efficiently contact all their employees to check on and alert them during an emergency.

Another vital component to a business continuity plan is to collect contact information, including cell phone numbers, for their suppliers, vendors, and key customers. Keep this information in print and online, and store copies off-site in case you can't get into your office.

A host of legal and medical questions may arise for small business owners if swine flu roars back with a vengeance this fall.

Imagine you run a small business like a day-care center, where vulnerable children congregate and colds and flu are prevalent. Do you close and send your entire staff and all children home at the first sign of any flu? Do you send home only sick children and sick staff? When? When do you reopen or allow them to return? What information and medical clearance would you need to send staff or children home, allow them to return, close, or reopen the center? These are not easy questions.

• Backup Staff

Janco recommends that companies prepare for operational disruptions by doing employee cross training or lining up backup staff now. Employers should review and enhance existing emergency disaster plans to ensure business continuity. Employers that are just getting started should develop a plan that includes pandemic preparedness, and review it and conduct drills regularly. A checklist for flu policy is posted at the government's flu awareness Web site.

Aside from preparing and practicing for pandemic, small business owners may want to check with their attorneys for advice on unusual situations -- What do you do with employees who are medically vulnerable to the flu or those with young children or elderly relatives at home? Do you send them home? When and for how long? With pay?

• Paid Sick Leave?

The federal Family Medical Leave Act provides eligible employees with up to 12 weeks of unpaid leave to care for themselves or sick family members. Generally, FMLA regulations do not cover flu absences unless complications arise, but courts recently have interpreted the FMLA to mandate leave for the flu and other viral infections.

However, the federal law does not cover firms with fewer than 50 employees. Small employers usually do not have to provide sick leave, so it is a surprise to many employees that they are not entitled to any sick leave, much less any paid sick leave.

Another question for your human resources manager and/or attorney is what communications responsibility you have as a business owner if one of your employees is diagnosed with swine flu. There are health confidentiality and privacy issues for employees, so employers should not disclose personal health information. But employers do not want a modern day Typhoid Mary spreading swine flu at work. If there is an employee with confirmed swine flu, some employers are alerting employees that there may be swine flu exposure at work without identifying the involved employee.

You might need to think about giving an infected person's immediate co-workers enhanced sick leave to protect themselves or family members, particularly if they have particular medical vulnerability to the illness, he says. Some employers bring in cleaning crews to disinfect an office where swine flu has been found. Providing hand disinfectant for employees is not a bad idea.

- more info

---

Cloud is not as secure as many thought

T-Mobile and Microsoft Sidekick is a set of exterior shells (for mobile phones)  that can be personalized  and provides the capability to record, play and share videos: record videos using the camera; receive video attachments from e-mail, picture messaging, or side load videos to the microSD card; play video using the built-in media player; share videos via e-mail, Bluetooth or picture messaging. 

Sidekick failed and lost user data.  On the face of it, there are some obvious lessons to be learned from the Sidekick snafu, even as Microsoft Corp. reported today that most of the data that was missing will be recovered from servers at its Danger Inc. subsidiary.

The lessons learned are:

• Back up your mobile phone's critical data independently - on a laptop, a desktop or a thumb drive.
• Raise questions about cloud computing and related services.
• Find out how your mobile device stores data, and make sure you understand it.
   
  The Sidekick incident should serve as a reminder to users to back up critical data. You cannot rely on cloud services to be 100% available all the time.

Not only is a backup of critical data imperative, users need to have a way to retrieve the backed-up data. CIOs need to think about the value of the data and what happens if the service is not available. There are many Internet-based services that can be a second backup version to the original backup, such as Plaxo. Having the second one drastically reduces the odds of total loss.

At larger companies, data backups are commonplace and often include information contained on wireless phones as well as desktop computers, analysts said. The issue becomes more difficult when IT shops trust users who put critical company data on personally-owned wireless phones that aren't backed up.

Despite urging users to back up critical data, Staten joined three other analysts in remaining faithful to the mobile phone industry's strong push for cloud computing services, noting that the Sidekick case was relatively isolated.

Nearly every major smartphone provider is working on some version of cloud computing to back up data from smartphones and other cell phones. All those services could be vulnerable to data loss, and the Sidekick example is likely to prompt a broad re-examination of internal server backup procedures.

One added is risk is that backend services open enterprisees up to having data potentially lost, stolen or replicated somewhere that enterprises do not have knowledge of.

Imagine if this happened across an entire carrier's servers. For Verizon Wireless that could be 90 million people. Everybody should think twice if these services could really save your data up in the cloud.

- more info

---

Huge Waves - Office Buildings and Businesses Demolished

A series of tsunamis smashed into the Pacific island nations of American and Western Samoa killing possibly more than 100 people, some washed out to sea, destroying office buildings and homes, and injuring hundreds. Television images showed offices and homes ripped apart, cars submerged in the sea or lodged in trees and large fishing boats hurled ashore by the waves generated by a 8.0 magnitude quake southwest of American Samoa.

   

 

A second 7.9 magnitude earthquake hit the Indonesian island of Sumatra late.

Disaster officials said the toll may reach 100 as rescuers search for bodies in flattened villages along the southern shore of the island of Upolu. Twenty villages on Upolu's south side were reportedly destroyed, including Lepa, the home of Samoa's prime minister. The area is also the main tourist area, and the waves destroyed some resorts. In neighboring American Samoa at least 24 people were killed and 50 injured with the southern portion of the main Tutuila island "devastated". The death toll there may also rise, said officials.

Huge Waves, Buildings Demolished

The waves that hit Pago Pago village were about 20 feet high. Some buildings were demolished by the waves, you know, there are no buildings anymore except the foundation. In addition, the island of Tonga was hit by a 13-foot wave on its northern coast. Tongan officials confirmed seven people were killed, while three were missing late on Wednesday.

Small tsunamis also reached New Zealand, Hawaii, and Japan.

Some areas have been flattened and the tsunami brought a lot of sand onshore. The Samoan resort Sea Breeze on the Southside of Upolu was destroyed when the waves hit it. The restaurant just floated out to sea complete, until it was smashed up in the water.

- more info