Securing SaaS Applications
Pradnyesh Rane · Auerbach Publications eBooks · 2011
It’s time for another security patch to be applied to the intranet site. is is the internal site that tracks all project work and deliverables. No problem: nothing major included in the patch. Information technology (IT) has been performing daily incremental backups and weekly full backups. IT rotates the tapes off-site on a weekly basis and keeps the quarter-end backups for two years. Due to budget restrictions, there is no test environment for the intranet. IT installs the intranet site patch; the server reboots well and comes up displaying the main internal intranet page. An internal user clicks on a link for a critical project-oops, a 404 web error, page not found. IT restores the files from a backup tape-oops, there are no files on the tape, yet all the backup jobs showed no aborts or errors. IT recalls the off-site sites for the last month: no files on any tapes. IT needed to go back two months off-site before finding a valid backup tape. IT sends out an e-mail to the user community that project files have been lost for the last two months. How many projects were lost? How many critical reports were gone? Has this ever happened to your enterprise? Has the off-site facility ever “lost” a backup set of tapes? What would happen if the application software were lost? Would the data backups be useful? If no losses, well done for the enterprise backup and recovery processes being documented and tested on a regular basis. If so, then the enterprise may want to enhance their existing processes to prevent this type of incident in the future.