2 cissp ® Official Study Guide Eighth Edition

participating 
organizations.
■
Confidentiality concerns often prevent businesses from placing their data in the hands of 
others. These may be legal concerns (such as in the handling of health-care or financial 
data) or business concerns (such as trade secrets or other intellectual property issues).
Despite these concerns, an MAA may be a good disaster recovery solution for an organi-
zation, especially if cost is an overriding factor. If you simply can’t afford to implement any 
other type of alternate processing, an MAA might provide a degree of valuable protection 
in the event a localized disaster strikes your business.
Database Recovery
Many organizations rely on databases to process and track operations, sales, logistics, 
and other activities vital to their continued viability. For this reason, it’s essential that you 
include database recovery techniques in your disaster recovery plans. It’s a wise idea to have 
a database specialist on the DRP team who can provide input as to the technical feasibility 
of various ideas. After all, you shouldn’t allocate several hours to restore a database backup 
when it’s impossible to complete a restoration in less than half a day!
In the following sections, we’ll cover the three main techniques used to create offsite 
copies of database content: electronic vaulting, remote journaling, and remote mirroring. 
Each one has specific benefits and drawbacks, so you’ll need to analyze your organization’s 
computing requirements and available resources to select the option best suited to your firm.

---

826
Chapter 18 
■
Disaster Recovery Planning
 Electronic Vaulting 
In an
electronic vaulting
scenario, database backups are moved to a remote site using bulk 
transfers. The remote location may be a dedicated alternative recovery site (such as a hot 
site) or simply an offsite location managed within the company or by a contractor for the 
purpose of maintaining backup data. 
If you use electronic vaulting, remember that there may be a signifi cant delay between 
the time you declare a disaster and the time your database is ready for operation with 
current data. If you decide to activate a recovery site, technicians will need to retrieve the 
appropriate backups from the electronic vault and apply them to the soon-to-be production 
servers at the recovery site. 
Be careful when considering vendors for an electronic vaulting contract. 
Definitions of electronic vaulting vary widely within the industry. Don’t 
settle for a vague promise of “electronic vaulting capability.” Insist on a 
written definition of the service that will be provided, including the storage 
capacity, bandwidth of the communications link to the electronic vault, and 
the time necessary to retrieve vaulted data in the event of a disaster.
As with any type of backup scenario, be certain to periodically test your electronic 
vaulting setup. A great method for testing backup solutions is to give disaster recovery 
personnel a “surprise test,” asking them to restore data from a certain day. 
It’s important to know that electronic vaulting introduces the potential 
for significant data loss. In the event of a disaster, you will only be able to 
recover information as of the time of the last vaulting operation.