RE: QSECOFR password

I second the recommendation about storing the hardcopy of the password
with the off-site tapes. 


John A. Jones, CISSP
Americas Information Security Officer
Jones Lang LaSalle, Inc.
V: +1-630-455-2787  F: +1-312-601-1782
john.jones@xxxxxxxxxx

-----Original Message-----
From: Steve Landess [mailto:sjl_abc@xxxxxxxxxxx] 
Sent: Wednesday, March 16, 2005 9:36 AM
To: Midrange Systems Technical Discussion
Subject: Re: QSECOFR password

> Dave Snyder wrote:
> In thinking about disaster recovery, if everyone who knows our QSECOFR

> password is gone, and our location that we store a hard copy of the 
> password is destroyed, and we restore our system at a disaster 
> recovery site, is there a "back door" to resetting the QSECOFR 
> password, or where would we stand at that point?
> I do not need specifics at this point, just wondering how deep of a 
> hole would we be in for such a situation.

Dave -
In this situation, you would be able to recover the password, but it
will require the assistance of an IBM SE and you'll have to pay for
their minimum # of hours to perform this task.

I'd suggest that you need to keep a hard copy of the password and a set
of backup tapes in more than one offsite location, like a safe at the
disaster recovery center, a remote office, or a secure site like a bank
safe deposit box far from your data center, so that there is low or no
likelihood that the disaster that destroyed your data center will also
destroy this storage location.

BTW, remember the skits where Dave Letterman used to drop things from
buildings?  John Brandt has a story about an AS/400 that was dropped
from a building for a disaster recovery test and was recovered and
running within two hours!  

Regards,
Steve
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.




This email is for the use of the intended recipient(s) only.  If you have 
received this email in error, please notify the sender immediately and then 
delete it.  If you are not the intended recipient, you must not keep, use, 
disclose, copy or distribute this email without the author's prior permission.  
We have taken precautions to minimize the risk of transmitting software 
viruses, but we advise you to carry out your own virus checks on any attachment 
to this message.  We cannot accept liability for any loss or damage caused by 
software viruses.  The information contained in this communication may be 
confidential and may be subject to the attorney-client privilege. If you are 
the intended recipient and you do not wish to receive similar electronic 
messages from us in future then please respond to the sender to this effect.