Development and implementation of disaster recovery plan in stock exchange industry in Indonesia

3.1 Project initiation

As mentioned in ref. [19], the first step in the development of DRP is to make the organizational structure of resources who will be responsible for running the DRP and allocating duties and responsibilities to resources of each team. The organizational structure created can be divided as follows:

1. Business continuity management (BCM) steering committee

2. Disaster recovery team

3. Emergency response team

4. Crisis operations team

5. Crisis recovery team

6. Compliance team

As mentioned in ref. [20], each team consists of a team leader and team members. Executive management is responsible for determining the team leader and team members. Team leader is responsible for coordinating the team members to work in accordance with the responsibilities that have been determined.

3.2 Risk analysis

Risk analysis is a process for identifying threats and measuring the level of risk that is acceptable to the company. As mentioned in ref. [15], the method used in risk analysis used references from ref. [17], guide for conducting risk assessments. As mentioned in ref. [17], the early step of risk analysis begins by identifying threats and vulnerabilities in the company information system that can be exploited by threat. Threats can be grouped into unauthorized access (hackers, etc.), structural issues (hardware failure, software malfunction, network failure, etc.), and environmental issues (fire, flood, earthquake, terrorist/bombing, power outage, etc.) [26].

As mentioned in ref. [14], threats and weaknesses can be identified from the system information specification that was gathered from various information such as questionnaires and documentation. The next step is to determine the likelihood. Likelihood is the analysis of the likelihood rating that can be explained from very low, low, moderate, high, or very high. The next step is to determine impact rating of the threat that could cause the downtime of the information system and thereby loss for the company. Impact rating can be explained from very low, low, moderate, high, or very high depending on how big the impact on the company is. The last step is to determine the level of risk. As mentioned in ref. [21], the level of risk can be obtained by multiplying the value of likelihood rating and impact rating as shown in Table 1 below.

3.3 BIA

As mentioned in ref. [2], BIA is a business analysis that measures the impact of a disaster on the company to define the business processes that are considered critical and the main focus of the company’s business continuity activities. The method used in the BIA is as mentioned in ref. [8], using references from ref. [16], contingency planning guide for Federal Information Systems. As mentioned in ref. [22], there are 3 steps involved in BIA:

1. Identify critical business processes at work unit

   System information in a company can be very complex and often support multiple business processes. Each work unit has a different system to run business operations. In order to better understand the impact of system outages or disruptions in the company, we must identify critical business processes and processes that depend on information technology. To identify critical enterprise work units, we need to analyze the company business processes in order to determine the work unit that uses the system for every day operations so that when the system encountered a problem and cannot be used then the business operations will be halted.

2. Identify required resources

   Restoration requires an analysis of the resources needed in order to continue the business process as quickly as possible. We need to identify the critical resources to analyze the company’s business processes to determine the information systems used by the critical work unit in running the business operations.

3. Identify system information priority recovery

   Based on the results of the previous process identification, priority recovery can be determined by considering the critical business processes that are directly related to the company’s information system. Results of identification will get priority order recovery system used in the disaster recovery process.

3.4 Recovery strategy

Recovery strategy is needed to reduce the risks arising from the interruption of information systems. Recovery strategies include backup method that will be used, and location alternatives including systems and infrastructure.

3.5 Recovery procedures

As reported in refs. [3,5], recovery procedure is a set of procedures established to regulate the procedures performed by the employee in carrying out the DRP when a disaster occurs until the restoration of the company business operations. Recovery procedure is based on reference guidelines of BCP exchange members and adapted to the company’s standard operating procedure (SOP) [10].

3.6 Testing and review

After all the DRP development process is completed, testing needs to be done to ensure effective implementation of DRP that has been created to work well in a state of disaster. The testing process is carried out by making a simulation. Simulations will be conducted on a Saturday, wherein the disaster scenario has occurred at the central office so that the system in the data center cannot be used. The testing process will also be assisted by external reviewers who will oversee the running of test simulations of DRP the company and report the results of testing the DRP after completion.

3.7 Documentation

Results of DRP development will be documented into a report that will be used as a guide in implementing the DRP.

4.1 Project initiation

In the first step, we need to ask approval from management before starting the project because the management is responsible and involved in the process of developing DRP. Next we need to establish an organizational structure to support the implementation of DRP in order for the recovery to be carried out effectively. The organizational structure is described as shown in Figure 1:

• BCM steering committee is a committee/board of directors consisting of executive management that make strategic decisions related to business continuity planning.

• Disaster recovery team acts as the main coordinator of all activities of the DRP which coordinates with all other teams to operate DRP.

• Emergency response team to act as a coordinator in the initial response at the time of the disaster, which is responsible for the evacuation of resources for human safety and the protection of critical company assets.

• Crisis operations team acts as a coordinator in the recovery of the company operational processes performed by each unit of work.

• Crisis recovery team acts as a coordinator in the process of recovery systems and infrastructure that will be used temporarily when a disaster occurs.

• Compliance team acts as the main coordinator in monitoring the compliance function of company policy and regulations in the process of recovery of business processes.

Figure 1

Organizational Structure of DRP.

The person who initiates this recovery operation is chosen from the BCP steering committee, who will send instructions to the lower level individuals detailing the steps to be performed.

4.2 Risk analysis

The next step is risk analysis. Risk analysis is a process that begins with the identification of threat, vulnerability, likelihood, impact, and level of risk. Threats and vulnerabilities of information systems are obtained from data collected from a wide variety of information such as questionnaires and documentation. Threats and vulnerabilities are listed in Table 2 below:

Likelihood rating obtained from interviews and documentation: Results of the interviews will be analyzed using the mode method to find the data most frequently occurring or has the greatest frequency. The Impact result will be obtained from interviews. Results of the interviews will be analyzed using the mode method to find the data most frequently occurring or has the greatest frequency

Results of data collection likelihood and impact rating that has been collected are listed in Table 3 below.

From Table 3, it can be seen that for earthquakes and terrorist/bombing, threats have a low risk level which means that if the threat occurs, it can provide a limited adverse effect on the operations of the company, the assets of the company, individual, or other organizations. Hackers’ threat has moderate risk level which means that if the threat occurs, it can give a serious adverse effect on the company’s operations, assets of the company, individual, or other organizations. Software malfunction, network failure, hardware failure, fires, floods, and power outages have high risk level which means that if the threat occurs, it can give a severe adverse effect on the company’s operations, asset, individuals, or other organization.

For the threat of hacker, we implemented the Use Multi-Factor Authentication and implemented the Password Manager

We implemented continuous and effective testing as well as having a solid software execution plan and pre-road-mapping plans can help your team go a long way in effective software development on the risk reduction on software malfunction.

Failure in networking can occur in routers and switches, as well as services such as DHCP and DNS servers, and everything else that keeps data moving on your network. Data cables and power supplies to the data center are further examples where resource failures can occur. Preventing such consequences can take numerous sorts. The first and most evident requirement is long-term power production capability. When electricity is off, most data centers feature diesel generators that can run for extended periods of time with little impact on the business. There is also battery backup linked to an inverter to function as a buffer between when the main power goes off and when the generator powers up.

Hardware failure can occur when components of your IT infrastructure cease to function. Hardware failure can occur for a variety of causes, including power grid voltage spikes, water damage, or electrical component failure due to age or a lack of maintenance. These can have a particularly catastrophic impact on operations if not properly planned for. The prevention includes maintenance of fans, ducts, and filters on a regular basis on all the servers and rack-mounted equipment. Dirt will eventually clog the airflow of any equipment that has a fan (or numerous fans) installed.

To explore more we apply on measurement on earthquake risk using engineering risk analysis. Experts can determine the likelihood of each cause of failure, the likelihood of earthquake that might harm the facilities, and the likelihood that an earthquake will leave the facility inoperable for a specific period of time following the earthquake. The same calculation may be conducted if specific adjustments are implemented, such as anchoring equipment, installing emergency generators, on-site water supplies, and so on. With as-is and what-if risk estimations, one may make more educated judgments regarding the costs and advantages of remediation. Contingency plans can be designed for situations that cannot be remedied cost-effectively.

There are several things you can do to avoid a fire – in some circumstances, fire prevention is more effective than any fire protection device. It is advised that you use the most recent edition of NFPA 75: Standard for Fire Protection of Information Technology Equipment from the National Fire Protection Association.

In addition, we can use the following fire prevention strategies:

• Store combustible goods away from the computer room – storing combustible materials in the computer room increases the likelihood and spread of fire. Keep supplies to a minimum in the area and keep boxes, packing, and manuals elsewhere.

• Check power cords – frayed or broken power lines provide a fire hazard since a spark might readily ignite the area. We need to check for damage and have repairs done as soon as possible.

• Train staff and post fire emergency plans – making sure the personnel understand how to react to a fire (whether that means using a fire extinguisher properly or promptly evacuating to safety) may save lives and help avoid more damage.

• Schedule frequent fire protection system inspections – the life safety and fire protection systems are only effective if they are in good working condition. Schedule frequent inspections with a competent fire prevention firm in certain area, such as state systems. They can check that the equipment is not only operational, but also that it complies with all local and state fire regulations.

Flood: water damage in the server room and data center will have serious consequences. Not all water damage in a data center, server room, manufacturing facility, or warehouse must be severe. Water penetration often causes merely a short-circuit. Larger floods will probably cause significant damage to the computer center. We recommend using a water leak detection system with sensors and alarm servers. Water leaking may be detected early with the use of a water sensor or the new water-detection chain. The sensor probe remote monitoring equipment will notify IT employees of accidents in the computing center/server room/production area by email, SMS (via gateway), or SNMP trap to network monitoring system.

Terrorist/bombing: we maintain regular touch with the government entity that takes up security measures to safeguard persons and organizations that might become targets of terrorist/bombing attacks. This lowers the likelihood of a terrorist assault. We maintain regular touch with the government entity that takes security measures to safeguard persons and organizations that might become targets of terrorist/bombing attacks. This lowers the likelihood of a terrorist assault.

There are three ways to protect data during a power outage such as power outage, power spikes, power outages and brownouts. Installing an uninterruptible power supply (UPS) is an effective method of protecting data against brownouts and unexpected power outages. While the user saves active data, the system keeps the computer functioning for a few minutes longer. The user may then securely shut down the equipment without causing damage to the devices or losing data. The UPS is often used as a battery backup solution for a computer.

Even if a generator is installed, a UPS is strongly recommended to avoid the short power loss during which data is lost and equipment is harmed until the generator kicks in. With power outages and load shedding occurring on a weekly basis, a comprehensive strategy must be put in place to limit the harm caused.

4.3 BIA

4.4 Recovery strategies

4.5 Recovery procedures

At this stage, a procedure that needs to be done in recovery process would be created when disaster occurs. Recovery procedure is based on reference guidelines BCP exchange members and adapted to the company’s standard operating procedure (SOP). The process recovery procedures will be assisted with work units that have responsibility in the process of business operations such as compliance unit, risk management, and also the management company. The procedures required in performing the recovery is as follows:

1. DRP activation procedure

   The purpose of the activation procedure is to provide guidance for companies in the activation of DRP. The guide contains an examination of any disruptions that occur, as well as the measures that must be taken to activate the DRP.

2. Emergency response procedures

   This procedure is a guide to the personnel in the emergency response team for the implementation of emergency response activities when disaster occurs, which includes rescue and protection of resources and important assets of the company.

3. Crisis recovery procedures

   This procedure is a guide to the personnel in a crisis recovery team for running the system recovery, infrastructure, and human resources that support the company business operations.

4. Operational procedures during crisis

   This procedure is a guide to the personnel in a crisis operations team for carrying out the activities of recovery of critical business processes that are owned by the company.

5. IT maintenance procedures

   This procedure is a guide for the personnel included in the crisis recovery team for the implementation of recovery systems and IT infrastructure that support the business operations of the company. The main objective of the system maintenance and related IT infrastructure is to ensure that DRP is always kept up to date and in accordance with the company’s current condition, complete, accurate, and ready to be implemented under conditions of a disaster.

Prior to the activation of disaster recovery process, the activation procedures must be sufficiently relevant, practical, and actionable. Plan testing is required, but the first step is to check that all activation requirements have been met. To that purpose, activation processes should be developed in accordance with three key guidelines:

1. The scope of activation must include five activation scope keys to guarantee that linked processes are fully actionable (considering DRP scope and specifics).

2. Activation guidelines must concentrate on triggering events and situations in order to properly examine and evaluate present conditions and decide if the DRP should be triggered.

3. Activation steps must be established in order for them to be carried out in a consistent and ordered manner. Everyone should understand what they need to accomplish and how to do it.

Below are five activation scope keys.

The sum of all relevant strategies and processes to guarantee that the DRP may be implemented when required and in an orderly and effective manner, comprising the five parts are listed below:

1. Criteria for activation: identifying the exact crisis circumstances that cause plan activation (according to type, severity, impact, and duration).

2. Evaluation procedures: to assess probable catastrophic occurrences and verify that activation conditions are satisfied.

3. Mechanisms of approval: to get suitable plan activation permissions, taking into account IT management professionals, line of business management personnel, and corporate leaders.

4. Logistics of activation: to guarantee that all facilities and systems, including the specified command center site, are available as required to support the plan activation, including the majority of, if not all, disaster recovery “command and control” tasks.

5. Communication protocols: all activation-related decisions and actions must be communicated to all workers and other interested parties (customers, vendors, suppliers, and the general public).

4.6 Testing and review

Simulated testing needs to be done to test whether the development of DRPs can work well. Simulation testing will be conducted on a Saturday in accordance with the schedule set by the Indonesia Stock Exchange. In the scenario of testing being conducted, in the main office, system does not need to be turned off because the remote trading system cannot work if the system is not connected with the company Indonesia stock exchange system. Team members only need to connect the connection with systems belonging to the Indonesia Stock Exchange in DRC and recovery of data into the system for use and testing. All employees of the company shall participate in the simulation process.

4.7 Documentation

Results of the analysis processes in the development of DRPs that have been made will be documented for the company. The documentation includes background, DRP organizational structure, risk analysis, BIA, recovery strategies, recovery procedures, and the required supporting documents.