Justifying Business Continuity: How it Impacts Risk Management

Transcription

1 Justifying Business Continuity: How it Impacts Risk Management Joe Elliott Neverfail

2 2

3 Agenda Definition of Business Continuity Road Blocks to Justification Defining Risk Management Reduction through the Business Impact Analysis Questions 3

4 Defining Business Continuity The ability of an organization to continue to function, even after a disastrous event. Enabling employees to continue to execute job functions, regardless of the risk Accomplished through: The deployment of a business continuity plan, processes, and controls Technology Data Business resumption planning 4

5 Agenda Definition of Business Continuity Road Blocks to Justification Defining Risk Management Reduction through the Business Impact Analysis Questions 5

6 Road Blocks to Justification Insurance Internal, IT issue Lack of knowledge System dependency Vulnerability Reach, etc Impact can be hard to quantify Solutions market is very large Worst case scenario focus 6

7 Road Blocks to Justification Insurance Internal, IT issue Lack of Knowledge System dependency Vulnerability Reach, etc Impact can be hard to quantify Solutions market is very large Worst case focus 7

8 Overcoming Road Blocks Change the mindset Identify what is critical Assess Your Vulnerability Build the full business case Make decision based off appropriate information 8

9 Change the Mindset Not a question of if, but how often Even five 9 s has downtime Expensive undertaking, Still 8+ hours per year Anything less than five 9 s How much is not as important as when Close Knowledge gap with systems Disaster Recovery vs. Business Continuity Often thought of as 1 in the same Trouble with Recovery Shift the focus to Continuity Business Continuity covers all potential outages Not just worst case scenarios Definition of Risk Management 9

10 Agenda Definition of Business Continuity Road Blocks to Justification Defining Risk Management Reduction through the Business Impact Analysis Questions 10

11 Risk: Anything that keeps an organization from meeting it s objectives

12 Risk Management = Security + Business Continuity

13 Risk Management Equation Security Proactive, front-end response Focus on mitigating and managing threats Not 100% Biggest impact of a breach = Downtime Business Continuity Reactive response to breaches How efficiently & effectively you continue operations Covers threats that Security does not address (server crash, application failure, power outages, disasters, etc) Involves data, process, applications, and people Effective Risk Management has to address both 13

14 Mitigating Risk Prioritization of Risk By degree of probability and loss Deal with highest Risk first Risk Management Options Avoidance avoid activities that have risk Retention accept the occurred losses Transfer have 3 rd party accept the risk Reduction reduce the impact Reduction is only option for critical processes Security reduces the frequency of a loss, but not severity BC plans and technology reduce both Maximum reduction Bridge data with people Done through applications 14

15 Agenda Definition of Business Continuity Road Blocks to Justification Defining Risk Management Reduction through the Business Impact Analysis Questions 15

16 Identify What is Critical Deeper than 1000 foot level What is nice to have vs. critical? Start with processes (sales, acct, cust serv, etc) Which processes are imperative? Why are they critical? How far do they reach? Who owns the process? Who is responsible for the execution? What percentage of the business is it responsible for? What applications/technology support the execution? Link Systems (IT) to Process (Users & Management) IT enables, Users and Mgt are responsible for Creates inclusion and ownership 16

17 Identify Threats Types of outages Configuration, people, and processes 80% per Gartner Data corruption Hardware failure Application failure Network failure Performance issues Disasters Disaster Recovery = Recovering when a disaster occurs Business Continuity = Enabling the business to function in all circumstances 17

18 Assess Your Vulnerability Deep Dive into Critical Processes Identified What is the impact of this process being down? Revenue Relationships Internal Productivity External Productivity What does it cost? Involves process owner Financial resources can give insight into hard dollar cost How easy is it to replace lost data or work product? How much does it cost to replace it? How easily can we adapt to the loss of the process? Can we work outside the existence of the process? Are there critical windows when the process must be available? Etc 18

19 Choosing the Right Option Risk Analysis Probability of occurrence Backup Data Replication Application Failover User Continuity Negative Impact 19

20 Justification - Critical Success Factors Link IT (systems) with Process (users and mgt) IT enables, Users & Management are responsible Create Inclusion and ownership Need Executive Sponsor Assign costs when possible Define project: DR or BC? Disaster Recovery: Enable recovery when disaster occurs Business Continuity: Enable the users to function in any event BIA serves 3 main functions 1. Confirm if there is a need or not 2. Process alone will help identify lagging areas 3. Creates and justifies the business case 20

21 Thanks! Questions? Joe Elliott (512) , ext 1824 Rick Popp ARGO Strategic Management (804)

22 About Neverfail Neverfail a global software company providing affordable data protection, high application availability and disaster recovery software solutions for the Windows technology platform. In business over 13 years, with experience in Business Systems availability Migrated from Disaster Recovery Consulting Firm to Software Company Strong Technical Pedigree CTO and lead Development team have decades of experience at Tandem/Compaq/HP High Performance Research Center International Presence North America Headquarter and Partner Network United Kingdom ROW Headquarter and Partner Network EMEA Distributors Asia/Pac Distributors 22

23 User Continuity for Critical Applications User Continuity Immediate and non-disruptive failover, keeping users seamlessly connected to working applications, regardless of failure type and physical location. 23

24 User Continuity Keeping users connected to critical applications No manual configuration changes No need to restart applications No unnecessary switchovers No visible downtime Regardless of the cause of failure Configuration Data Server Application Network Performance Disaster Reliability (foreseen/predictable problems) + Resilience (unforeseen/unpredictable problems) 24