Angel security.

Mike Hagar knows something about disaster recovery. On the

That quick decision saved them, as they were able to take the elevator straight down 37 floors and get out of the building just in time to see a plane circle and strike the building above them. With debris raining down, Hagar's client then asked what they should do. Hagar made a quick call on his cell phone to Sungard Availability Services to reserve backup space at a data center in Colorado for the client, whose network would be back up and running in less than five hours.

That was the last call he would be able to make that day. But Hagar had another almost out-of-body experience a few minutes later as he stood on an empty New York City street watching a cloud of dust barrel toward him--call it his "angel" moment--that may have saved his life a second time.

Today, Hagar is an enterprise security advisor for Unisys Corp., a frequent writer and speaker on disaster recovery and network security issues. He uses 9/11 slides in his presentations and his remarks carry much weight based on his experience that day.

According to Hagar, whom I met at the InfoSec show in March, enterprises appear to finally be "getting it" regarding business continuity, disaster recovery and risk analysis. They all go hand in hand, he says, and failing to pay attention to those areas can mean losing trust with customers. "When you lose the trust of your customers, you lose business," he says.

Hagar could not quite put his finger on the reason for the increased interest in business continuity, but to him, what is important is that organizations are beginning to understand both the necessity and the process of protecting their networks and intellectual property.

Hagar recommends a layered approach when setting up a security strategy, one that will defend the perimeter, provide internal controls and protect the data layer (e.g., digital rights management and audit capabilities). He also stresses security education and awareness, which he finds are often missing. "Organizations need to take a holistic approach versus point solutions," he emphasizes.

"Organizations need to first look at their security architecture before buying solutions," he says. "And the person responsible for ensuring five-nines on the network (i.e., the IT director) should not be responsible for security." Let me repeat that: He says the IT director should not be the person responsible for network security.

With his 9/11 experience, Hagar certainly has a compelling story to tell about business continuity and security--and if you ever run into him at a trade show, ask him about his "angel" moment from that day. Or you can e-mail me and I'll send you back the short tale.

Ken Anderberg

kanderberg@comnews.com