WP-DBManager Installation Issues

It really is a great plugin once you get it running. Unfortunately, depending on how your host has PHP configured on your server, you are likely to receive the following error when you attempt to backup your database for the first time:

If the PHP installation is configured properly, you’ll see the following screen instead:

Fixing your PHP installation so WP-DBManager works and you see the second screen instead of the first is as easy as adding the following code to your .htaccess file:

1
2
3
4
5

suPHP_ConfigPath /home/<your-path>/public_html
<Files php.ini>
order allow,deny
deny from all
</Files>

suPHP_ConfigPath /home/<your-path>/public_html
<Files php.ini>
order allow,deny
deny from all
</Files>

At this point, you’re probably wondering what this code actually does. Let me explain.

suPHP

suPHP is a tool for executing PHP scripts with the permissions of their owners. It consists of an Apache module (mod_suphp) and a setuid root binary (suphp) that is called by the Apache module to change the uid of the process executing the PHP interpreter.

suPHP _ConfigPath

This option tells mod_suphp which path to pass on to the PHP-interpreter (by setting the PHPRC environment variable). Do *NOT* refer to a file but to the directory the file resists in. You must have a valid php.ini file for the version of php you are using in the directory specified in this path.

E.g.: If you want to use “/path/to/server/config/php.ini”, use “suPHP_ConfigPath /path/to/server/config”.

Securing php.ini

The rest of this code secures the php.ini file in the specified path from access through a web browser. Restricting directory and/or file access s one of the most frequently uses of .htaccess. To deny all http requests for the restricted php.ini, add the “deny from all” directive as shown to your .htaccess file.

Photo by Lorraine Fox Costanzo

It’s no substitute for a viable disaster recovery plan, but a continuity of operations training program for IT’s business partners is essential. Establishing a training program became even more relevant when an audit of the Student Administration Systems found that the business had no Continuity of Operation Plan. The Student Administration business partners turned to UITS to provide guidance in developing their plan.

The first time I conducted an overview presentation for the Student Administration Directors, I was told that I scared them. I showed them the photo of the burned out data center and let them know about our water based fire suppression system. At first, they didn’t believe me until the CIO confirmed the facts with them. Before I left UConn, I facilitated a 3-hour workshop with the Graduate School Dean and his administrative staff. I provided them with template for a Facilities Resilience Plan and a Pandemic Influenza Plan.I also recruited a few trainers who can carry on the program without me. I hope UConn continues this training program and it doesn’t fall by the wayside.

Continuity of Operations Training Documents and Templates

All of these documents are in the public domain without copyright. Please feel free to download them and adapt them for your own use.

• Continuity of Operations Training PowerPoints:
  • BCP Overview (25 minute walk through)
  • Continuity of Operations Overview (1-hour presentation)
  • Continuity of Operations Group Workshop (3-hours)
  • Continuity of Operations TT&E (1-hour)
  • Developing a Corrective Action Plan
• Continuity of Operations Templates:
  • Facility Resilience Template
  • Pandemic Influenza Template

<– UConn Part 7: Remote Critical Infrastructure Protection Site

Technorati Tags: Business Continuity, Disaster Recovery, UConn, University of Connecticut, SDLC, Best Practice, Business Transformation

The harsh reality these days is that campuses all across America face similar threats to their health, safety, and economy. UConn’s Department of Public Safety plans for situations that include active campus shooter, international or domestic terrorism, severe weather emergencies, pandemic influenza, and other natural or man made disasters. As I departed UConn, an individual sent me this email:

A while back, I had the UConn Police dismantle a bomb making lab in MSB that a graduate student set up, so the risks you point out are actually quite real.

Since he sent this reply to the entire distribution list, it created quite a stir. As it turns out, the incident was reported in the news in the year 2000. It’s old news, but it punctuates the fact that we are at risk for a serious disruptive event every single day. Also, the UConn Storrs campus is situated approximately 35 miles from two nuclear facilities. UConn Storrs is designated as an evacuation destination in the event of an accident at the Millstone Nuclear Power Plant in Waterford, CT. A fast attack nuclear submarine base is located a few miles further south from Millstone in Groton, CT. The U.S. Navy will neither confirm nor deny the presence of nuclear weapons on the base, but if I had to venture a guess…I think our enemies might just consider the base a first strike target.

University Of Connecticut Health Center (UCHC)

The University of Connecticut Health Center (UCHC), located in Farmington, Connecticut, is an integrated academic medical center that is involved in three areas: academics, research, and clinical care. UCHC is at the center of Bioscience Connecticut, a plan introduced by Connecticut Governor Dannel P. Malloy and approved by the Connecticut General Assembly in 2011. It is home to the School of Medicine, School of Dental Medicine, John Dempsey Hospital, UConn Medical Group, UConn Health Partners, University Dentists and a thriving research enterprise. While UConn Health Center is closely linked with the University’s main campus in Storrs through multiple, cross-campus academic projects, functionally it operates almost as a separate entity with it’s own CIO and IT Group.

As a hospital, UCHC has multiple redundancy built into every one of it’s systems. After visiting several alternatives, I thought UCHC would make an excellent remote critical infrastructure protection site. The UConn Storrs CIO thought I had no chance of convincing UCHC officials to provide space in their data center for a remote site because of the political climate that existed between the two schools. I risked it anyway and met with the Chief Administrative Officer, Chief Information Officer, and VP of IT for UCHC. I explained to them what I was doing at Storrs, what my goals were, and simply asked for space in their data center. They said, ‘Yes!’

Remote Critical Infrastructure Protection at UCHC

With space secured, the new problem is, “How are we going to pay for the remote critical infrastructure build-out?” This is a question that, as of the time of this writing, is yet to be answered. It’s on the list of strategic priorities for the 2013-2014 fiscal year, but funding has not yet been approved. I applied for $4.26 million from Connecticut’s IT Capital Investment Program managed by the Office of Policy and Management. While they haven’t said no to any requests yet, and this project is on the list of those destined for approval, it still needs to be vetted by the bond commission because these projects are funded with public debt. Nobody knows what’s going to happen, but I can only hope that UConn’s leadership keeps the momentum going for this vital need.

<– UConn Part 6: Critical Infrastructure Protection

UConn Part 8: Continuity of Operations Training Program –>

Technorati Tags: Business Continuity, Disaster Recovery, UConn, University of Connecticut, SDLC, Best Practice, Business Transformation

Critical Infrastructure and Key Resources (CIKR)

CIKR are those components of the UITS critical infrastructure that are deemed so vital that their loss would have a debilitating effect on the safety, security, economy, and/or health of the University of Connecticut. Protecting and ensuring the resiliency of UConn’s CIKR is essential to the University’s security, public health and safety, economic vitality, and way of life. Attacks on or failures of CIKR could significantly disrupt UConn. Direct international or domestic terrorist attacks and natural, man made, or technological hazards could produce catastrophic losses in terms of human casualties, property destruction, and economic effects, as well as profound damage to student, faculty and staff morale and confidence.

Critical Infrastructure Protection Plan

A CIPP is a set of processes and procedures that serve to protect and recover these assets and mitigate risks and vulnerabilities. The CIPP defines the roles and responsibilities for protection, develop partnerships and information sharing relationships, implement the risk management framework, and integrate emergency preparedness, protection and resiliency of critical infrastructure.

Critical Infrastructure Protection at UConn

After the rush to prepare critical backup systems for Hurricane Sandy, Provost Mun Choi ordered UITS to establish the critical infrastructure protection site. I assembled a team of about 25 technical resources from the server support group, networking, the PMO, and data center operations. As a group we decided to use rack space in the Chemistry building’s telecommunication data center. That location has enough power, UPS redundancy and air conditioning to support our needs. We were given space for 2 racks. The Chemistry building is about 300 yards from the primary data center in the Math Science building (MSB). It’s not an optimal location because of its proximity to MSB, but it’s all that we had. The systems included at this site include:

• Authentication services (LDAP, Kerberos, CAS)
• Radius
• Active Directory
• Exchange

Two other emergency communications systems, RAVE and ListServ, are outsourced. We also purchased 100Gb of Hitachi storage to support these systems. The total cost for this site fell just short of $1 million USD. There are no load balancers and fail over requires some manual intervention, so at best we can only call this a warm site, and a temporary warm site at that.

The following critical communication websites are outsourced to the Amazon eastern region cloud:

• UConn.edu
• today.UConn.edu
• alert.UConn.edu
• itstatus.UConn.edu

These sites also require manual intervention for data synchronization and fail over.

I ran the project as a Scrum project and can’t speak more favorably of daily standup meetings to help keep project team members committed and accountable to each other. We ran into purchasing delays and school imposed moratoriums where we had to work around student schedules, exams, and breaks. The team working on this project also had their normal day-to-day support activities and other project duties on their plates. The project required approximately 6 months to complete and make ready for a complete fail over test. All component testing worked and we enjoyed an inadvertent test of Exchange when production servers had to be taken down for patching and the Exchange servers in Chemistry automatically picked up the load. The Chemistry site is a complete victory for UITS.

Because UConn’s Critical Infrastructure Protection Plan contains proprietary details, the document is not available for download.

<– UConn Part 5: BCP/DR Integration Into New Project Process

UConn Part 7: Remote Critical Infrastructure Protection Site –>

Technorati Tags: Business Continuity, Disaster Recovery, UConn, University of Connecticut, SDLC, Best Practice, Business Transformation

Business Continuity and Disaster Recovery are areas that most SDLCs neglect. Perhaps neglect is too strong a word, since purposefulness is implied when something is neglected, omitted might be better. Why is it then that many SDLCs omit BCP/DR? This is my opinion. I have no hard facts, but I believe most organizations don’t implement BCP/DR processes until something bad happens.

Look at the photo on the right. On March 19, 2008, a fire destroyed 75 servers, routers and switches in the data center at Camera Corner/Connecting Point, a Green Bay, Wisconsin business offering IT services and web site hosting. It took 10 days to get customer web sites back online, indicating the company had no live backup plan. That was a problem for one customer, the Green Bay Blizzard arena football team, which was counting on selling tickets online for their home opener. Camera Corner/Connecting Point CEO Rick Chernick insisted the company had thought a lot about disaster recovery:

As part of your plan: Where are you going to go? Where are you going to set up? Where are you going to put phones in?” Chernick said. “We had all that planned out so we knew where we were going to go…if we had a fire.

And yet customer web sites were offline for at least 10 days. The local media didn’t ask tougher questions about whether that was adequate.

Don’t Think, Do!

Thinking a lot about disaster recovery is not the same as actually having documented, exercised plans and a hot, warm, or even cold backup site ready to go. UConn’s University Information Technology Services (UITS) group had no documented plans. The data center is located in the Math Science Building (MSB). It is old, outdated, and there’s a high risk that it could be shut down due to water penetration. Plenum cabling is run under the flooring as it is with many older data centers. Water filled HVAC piping runs in the drop ceiling above all the production IT equipment. During my engagement, a heating pipe leaked. Fortunately, the leak happened in an area that is used for storage. No damage occurred to the production hardware. Of greater concern is the fact that the fire suppression system is water based. While the likelihood is remote that a fire would occur like the one in Green Bay, if just one wisp of smoke from a blown capacitor triggers the fire suppression system, UConn’s data center is toast. We all know how well water and electronic equipment mix.

SDLC New Project Integration

The Project Management Office (PMO) is now integrating the development of a Business Impact Analysis and Information System Contingency Plan into the planning phase of their SDLC for all new projects going forward. The goal is that no project will roll into production until both of these processes are complete. This is really a BIG deal for UITS. There has never been a Business Impact Analysis done for any of their supported systems, let alone contingency plans. Not only did I have to build the templates, but I had to build enough information into the planning documentation to teach people how to use them.

Cost is always a consideration for BCP/DR. Hot sites are expensive. They usually duplicate production and can function as a load balanced, automatic fail over site if something happens to take out the primary data center. Warm sites are less expensive, cold sites are the least expensive. The less you pay up front, the more the work required to get the site up and running in a disaster situation. You need to determine the proper cost/benefit ratio for your organization, but having something in place, anything in place, is better than having nothing at all.

<– UConn Part 4: BCP/DR Toolkit & Document Library

UConn Part 6: Critical Infrastructure Protection –>

Technorati Tags: Business Continuity, Disaster Recovery, UConn, University of Connecticut, SDLC, Best Practice, Business Transformation

Cover design by Katrina Garbiel

After forming the governance teams and dealing with Hurricane Sandy, much of my time was spent creating a BCP/DR toolkit and document library. When I arrived at UConn, all they had was a single document they called a Business Continuity template. It was wholly inadequate to serve the needs of BCP/DR program.

There are many documents that can written for a BCP/DR document library. My choice was to either write them from the ground up or adapt best in breed documents that already exist in cyberspace. Since I don’t believe in reinventing the wheel and I knew this assignment was a short one, I chose the latter. In a previous assignment working for the Space and Naval Warfare Systems Command Atlantic (SPAWAR), I became very familiar with IT documents from the National Institute of Standards and Technology (NIST) Special Publication 800-series. The series reports on research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations. The NIST provides the series for use or adoption by any organization without copyright. All the UConn documents are adaptations of this series as well as others from the Federal Information Processing Standards Publications (FIPS PUBS) also by the NIST.

Document Library and Toolkit Downloads

The documents in the document library toolkit are:

• Information Technology Contingency Plan and Planning Guide
• Business Impact Analysis Template
• Categorization of University Information and Information Systems
• Information System Contingency Plan Guide
• Information System Contingency Plan Templates for High, Moderate, and Low availability security objectives
• Testing, Training, and Exercise Planning Guide
• Templates for:
  • Tabletop Exercise Facilitator Guide
  • Tabletop Exercise Participant Guide
  • Tabletop Exercise After Action Report

Unfortunately, this toolkit remains incomplete. I didn’t have the opportunity to create the functional exercise guides. Since all of these documents are in the public domain without copyright, you are free to download them by clicking their links above. You may adapt them for your own use or hire me to adapt them for you (*wink*, *wink*).

<– UConn Part 3: UITS Emergency Operations Plan

UConn Part 5: BCP/DR Integration Into New Project Process –>

Technorati Tags: Business Continuity, Disaster Recovery, UConn, University of Connecticut, SDLC, Best Practice, Business Transformation

Photo Courtesy of NASA

Category 3 Hurricane Sandy, October 22, 2012 – October 31, 2012, produced winds as high as 115 mph (185 km/h) and was responsible for 285 deaths. It was the deadliest and most destructive hurricane of the 2012 Atlantic hurricane season, as well as the second-costliest hurricane in United States history. It was also an eye opening experience for UConn’s University Information Technology Services (UITS) leadership team.

Department of Public Safety’s Emergency Operations Plan

With over 40,000 students, faculty, and professional staff, the University of Connecticut operates like a small city with its own Department of Public Safety providing Police, Fire, and Emergency Medical Services. The department is led by Chief Barbara O’Connor, an exemplar of servant leadership. At any time on campus, there may be as many as 10,000 individuals in resident population. In addition, the Connecticut State Response Framework, developed by the Connecticut Department of Emergency Services and Public Protection (DESPP) and Division of Emergency Management and Homeland Security (DEMHS) in partnership with other CT State Agencies and Non-Governmental Organizations involved in emergency preparedness and response activities, requires the Department of Education to:

Coordinate shelter, mass feeding, non-surgical medical care, and temporary housing at state colleges, regional community colleges, and the University of Connecticut depending upon student populations.

On Thursday, October 25^th, the Department of Public Safety invited UITS to participate in a 3pm meeting to detail the planned opening of their Emergency Operations Center (EOC) and direct UConn departments to prepare their own responses accordingly. The key focus areas discussed were human and animal safety and communications. All departments were asked to make certain they provided representation to the EOC for the duration of the operational period.

Public Safety has had a written Emergency Operations Plan in place since around 2009. In the plan, UITS is designated as Emergency Support Function #2 with the following 5 core responsibilities:

• Coordinates between Telecommunications and Network Services and the EOC for all Campus telecommunications, and network services.
• Plans for and establishes alternate and emergency telecommunications and Network and in support of the emergency response operations
• Plans for the emergency installation of Campus telecommunications data networking for critical operations and programs
• Provides technical support to EOC
• Manages the utilization of the Volunteer Ham Radio Services when available

UITS Emergency Operations Plan Genesis

After the initial EOC briefing, UITS held it’s own internal briefing to plan our response. The meeting lasted about an hour and a half and we thought we covered everything necessary. I was designated as the EOC liaison and by default, the incident commander. I only learned later that the decision to have me lead the response was vigorously debated overnight by some members of the UITS leadership team because as a contract employee I had no official authority. The person who protested the most actually wanted to be the designated leader. Thankfully, she relented.

UITS Emergency Operations Plan Response

Since UITS did not have an IT contingency plan, the technical teams rushed to stand-up critical back-up systems to ensure communications would continue throughout the operational period. Fortunately, Hurricane Sandy did not cause any significant outages on campus and IT escaped without incident. There were power outages to some of the dorms and some dorm windows were blown out in the outlying areas. A construction containment fence was blown over on the main campus and we had a lot debris and tree branches. The most significant incident occurred near the campus in the town of Mansfield for which the UConn Department of Public Safety provides mutual aid response. An eighty-year old woman died as she tried to leave her home for safe shelter. As she was walking down her driveway, a large tree blew over on top of her killing her instantly.

Emergency Operations Plan After Action Report

When the operational period ended, I conducted an after action debrief. We documented our incident response, what we did well, and what we need to improve. The experience led me to develop the IT department’s Emergency Operation Plan (EOP). We had an opportunity to exercise the Emergency Operations Plan for the Blizzard of 2013. We were informed that the EOC was opening for weather monitoring purposes. We treated the incident as one requiring an emergency response and invoked the Emergency Operations Plan. We held our planning session using the Emergency Operations Plan checklists as our guide. Our planning session was complete in 25 minutes, down from the 1 1/2 hours that was required for Hurricane Sandy.

The UConn Emergency Operations Plan and Emergency Operations Plan After Action Report for Hurricane Sandy can be downloaded by clicking their respective links.

Want to laugh? Here’s something funny that happened during the Hurricane Sandy operational period. The UConn police department monitors Twitter feeds with Hootsuite. They learn about incidents on campus more rapidly from Twitter than from people calling 911 or using the campus emergency Blue Phone system. As we were watching the Twitter feeds, one student tweeted that he was “In the woods sitting near a tree hiding from the cops.” Now if you were a police officer and saw that tweet, what would you do? The officer in charge of the EOC drilled down on the tweet to view the student’s account. It was clear from the earlier tweets that the student was talking about going into the woods on campus to smoke an illegal substance. The student also had his phone’s location services turned on. The officer simply had to click on the tweet’s location and a map opened showing the woods and the tree the student was sitting near. So much for hiding from the cops!

<– UConn Part 2: BCP/DR Governance Teams

UConn Part 4: BCP/DR Toolkit & Document Library –>

Technorati Tags: Business Continuity, Disaster Recovery, UConn, University of Connecticut, SDLC, Best Practice, Business Transformation

Image by http://thegoldguys.blogspot.com/

As I began gathering requirements from key stakeholders, one major task that had to be accomplished is to develop a governance structure over the Business Continuity / Disaster Recovery (BCP/DR) program. At UConn, this is easier said than done because of the tenuous history between University Information Technology Services (UITS) and the independent IT organizations that evolved on campus.

Due to high turnover in leadership, a lack of consistent, measurable, repeatable process, and a long history of slow delivery, and failed projects or budget overruns, some of the schools that comprise UConn created their own independent IT organizations. This is just like the situation that existed at Pfizer when I worked there. Pfizer had a central IT organization that consistently failed in its mission. As a result, the five divisions grew their own independent IT organizations. Each had their own processes and none talked to each other. It took a transformational leader to change things. In this role at UConn, I had to be a transformational leader and be able to build two governance teams, work across a matrix organization, and drive change when I didn’t own or control any of the levers. I was successful and after a short while, volunteers were asking me to participate on the BCP/DR Working Group.

Steering Committee Governance

The first governance team I established (reconstituted actually) is the BCP/DR Steering Committee. The BCP/DR steering committee is a governance body that reviews, monitors and prioritizes BCP/DR projects from a cross-functional perspective. In addition to vision and leadership dimensions, the two key concerns of the steering committee are:

• Alignment. The committee helps ensure that the BCP/DR strategy is aligned with the University’s strategic goals.
• Ownership. The business units represented on the steering committee have ultimate ownership over the larger BCP/DR strategic decisions since those decisions will impact their processes.

There was an earlier BCP/DR Steering Committee that met one time under the CIO’s leadership after the news outlets made an issue of the lack of preparedness. I spoke to each of those early participants, reconfirmed their commitment and expanded the team by inviting participants from additional business areas. The team that eventually formed includes:

BCP/DR Working Team Governance

The working team is an IT management group focused on implementing the necessary programs and controls, delivering value, and measuring performance. Assembling a working team was slow work at first, but as news spread about what I was doing and the successes that were being achieved, the working team developed a life of it’s own. By the second monthly meeting, we had several new volunteers and recommendations for other participants from sitting members. The team that came together includes:

I don’t know what’s going to happen to these governance teams or to the momentum that we built up over the past few months. My contract at UConn ended a couple of months earlier than expected because of budget issues. No one has been named to replace me.

<– Bringing Business Continuity / Disaster Recovery to UConn

UConn Part 3: UITS Emergency Operation Plan –>

Technorati Tags: Business Continuity, Disaster Recovery, UConn, University of Connecticut, SDLC, Best Practice, Business Transformation

When I arrived at UConn, UITS had barely more than a basic BCP/DR Policy written by the Information Security Office that essentially says:

Each University department will maintain a current, written and tested Business Continuity Plan (BCP) that addresses the department’s response to unexpected events that disrupt normal business (for example, fire, vandalism, system failure, and natural disaster).

Apart from the policy, there was nothing else except a rudimentary Microsoft Word business continuity template that didn’t even come close to meeting the University’s needs. There were no IT contingency plans, no training materials, no instructions, no definitions, no other templates…nothing! How could anyone comply with a policy without the requisite accompanying program?

To complicate matters, UITS had been cited in audits for years for not having a Business Continuity and Disaster Recovery program in place. Around March of 2012, local news outlets picked up on the story about UConn’s lack of preparedness and the University’s reputation suffered. The audits also called out the need to hire a full time Business Continuity and Disaster Recovery Coordinator. As of this writing, that job has not yet been posted or filled. To date, the University has not provided a budget for Business Continuity and Disaster Recovery.

Business Continuity and Disaster Recovery Coordinator

In my role as Business Continuity and Disaster Recovery Coordinator, I reported into Jason Pufahl, Chief Information Security Officer. Jason shared his vision of what needed to be done and I was off to the races. At some point during the first couple of weeks, Jason commented, “I’ve never seen anyone hit the ground running so fast. Every time I talk to someone on campus about the need to meet and talk to you, you’ve already met with them!” For me it was no big deal. I was just doing my job. But what I accomplished for UConn over the next 6 to 7 months provided a foundation for a Business Continuity and Disaster Recovery program that rivals any other campus based resilience program in the United States. My hope is that they continue making progress in this vital area. What I delivered for UConn includes:

• BCP/DR Governance Teams Established
• UITS Emergency Operation Plan
• BCP/DR Toolkit & Document Library
• BCP/DR Integration Into New Project Process
• Critical Infrastructure Protection (CIP) Site in Chemistry
• Negotiated with University of Connecticut Health Center for CIP Remote Site
• IT Capital Investment Funds Requested
• Business Partner Training Program Established

This series of articles discusses the challenges discovered at UConn and describes how those challenges were overcome to build this program. All the documents created for the University of Connecticut are in the public domain and may be downloaded for your own adaptation.

UConn Part 2: BCP/DR Governance Teams –>

Technorati Tags: Business Continuity, Disaster Recovery, UConn, University of Connecticut, SDLC, Best Practice, Business Transformation

WordPress version 3.4 has been released. While many of the improvements are under the hood, there a few you need to know about. Watch the video and feel free to share it with anyone.