Networking Production Appliance Boards

[slgrieb]

One of the funniest/scary things I ever saw happened at a large financial planning firm. Big outfit. Anyway, one of my clients purchased a controlling interest from a couple of partners who wanted to retire, and he asked me to take a look at their setup because he wasn't too comfortable with the guy who did their computer work. The leading cause for concern was that the office manager wasn't sure if their server was being backed up correctly.

When I spoke to her, she said that every morning there was an error message displayed on the server, but their computer guy told her that it could be ignored 'cause the backup was really working. I asked her to show me the server.

Which turned out to be sitting on a counter in the break room next to the coffee maker. No surge suppressor, no UPS. Well, that surprised me! But it was only the beginning. Told her I wanted to look at the backup logs, and asked for the password for the server, only to be told that it wasn't password protected (old Compaq, NT 4.0). So, it turned out that the server hadn't been backed up in 8 months (the backup was too big to fit on a single tape cartridge without compression, which was disabled). and so it went during the entire audit. No passwords on the workstations, missing OS and software installation disks, you know the drill.

Anyway, at the end of the tour, the 3 senior partners asked for some recommendations. First and foremost I said was password protect everything, get the server out of the break room and lock it up, and did I mention a password? Oh, and one of those battery backup thingies would be nice too. After I explained my rationale, one of the partners said, "well, we don't have that much trouble with the power, and it seems awkward to move the server, and all". "I can't imagine that we'd ever have an employee that would erase or steal our client data. But I think we really need a formal disaster recovery plan."

I said, "If you aren't willing to practice due diligence, a disaster recovery plan isn't going to be useful. I'd say that if client data on the server is lost or compromised due to your negligence, you should just go up on the roof and jump. It'll hurt less than the lawsuits." Ah, the joy of having a friend who controlled the company, so I could say what I thought! A once-in-a-lifetime chance not to be wasted.

Of course, they did make the changes, I wrote a recovery plan, and for several years thereafter, I handled their routine little problems via LogMein, and showed up every month to do an onsite check where I was always made to feel as welcome as fecal matter in the punch bowl.