Is your disaster recovery plan really a security hazard