Business Continuity Planning and Disaster Recovery Planning

Transcription

1 Business Continuity Planning and Disaster Recovery Planning Ed Crowley IAM/IEM 1

2 ISC 2 Key Areas of Knowledge Understand business continuity requirements 1. Develop and document project scope and plan Conduct business impact analysis 1. Identify and prioritize critical business functions 2. Determine maximum tolerable downtime and other criteria 3. Assess exposure to outages (e.g. local, regional, global) 4. Define recovery objectives 2

3 ISC 2 Key Areas of Knowledge Develop a recovery strategy 1. Implement a backup storage strategy (e.g. offsite storage, electronic vaulting, tape rotation) 2. Recovery site strategies Understand disaster recovery process 1. Response 2. Personnel 3. Communications 4. Assessment 5. Restoration 3

4 ISC 2 Key Areas of Knowledge Provide training Test, update, assess and maintain the plan (e.g., version control, distribution) 4

5 Topics Business Continuity Planning Prime BCP elements Business Impact Assessment (BIA) Three types of backup services Disaster Recovery DR plan process Five types of DR plan tests 5

6 Goals Minimize loss Online services Retain value Maintain Regulatory Compliance Utility companies Government Orgs (FISMA) Finance (SOX..) Healthcare (HIPAA) 6

7 BCP/DR Assures viability of organizational digital assets through emergencies and disasters. BCP focuses on viability through routine emergencies. DR focuses on disaster recovery 7

8 BCP/DR Goals Business continuity Focus on business process At least yearly testing Disaster Recovery Heavy IT focus Allows implementation of business continuity plan Requires Planning and Testing 8

9 Scope BCP process: Scope specification and plan initiation Business Impact Assessment (BIA) Business continuity plan development DRP includes: Processes Procedures Testing 9

10 Contingency Plans Defined A plan for emergency response, backup operations, and post-disaster recovery maintained by an entity as a part of its security program that will ensure the availability of critical resources and facilitate the continuity of operations in an emergency situation National Computer Security Center, survey >35% of companies have no plans 10

11 Business Continuity Planning Prevents interruptions to normal business activity Protects critical business processes from man made and natural disasters Strategy Minimize disturbances effects Business processes resumption Disruptive Event Any intentional or unintentional security violation that suspends normal operation. 11

12 BCP Addresses Staff Electronic Infrastructure LANs/WAN & related Telecommunications/data links Workstations/workspaces Applications software Data Media and records storage 12

13 Sample Disruptive Events Natural Fire Flood Earthquakes Power Outages Man-made Bombings Strikes Communication infrastructure failure 13

14 Four BCP Elements 1. Scope and Plan Initiation 2. Business Impact Assessment (BIA) 3. Business Continuity Plan Development 4. Plan Approval and Implementation 14

15 Scope and Plan Initiation Scope Creation Detailed account of work required Resource listing Defined management practices 15

16 Roles and Responsibility Senior Management Ultimate responsibility Executive Management Initiates project, gives ongoing support and final approval BCP Committee Creates, implements, and tests plan. Senior Business Unit Management Identifies and prioritizes critical systems Functional Business Units Participate in implementation and testing 16

17 IT Department Role Make sure that adequate backup restore processes are available Employ sufficient physical security mechanisms to protect systems Ensure that the organization uses sufficient logical measures for protecting data Ensure departments implement adequate system admin including up to date inventories 17

18 FCPA 1977 Foreign Corrupt Practices Act imposes civil and criminal penalties if publicly held organizations fail to maintain adequate controls over their information systems. 18

19 Due Diligence If a disruptive event causes losses that adherence to base industry standard of due care could have prevented, through this concept stockholders may hold senior managers, as well as the board of directors, personally responsible. Due Diligence Means that the company can demonstrate that it has taken all reasonable steps in protecting its employees. 19

20 Due Care that level of diligence which a prudent and competent person would exercise under a given set of circumstances. 20

21 Comparison Due Care Minimum and customary practice of responsible protection of assets that reflects a community or societal norm. Due Diligence Prudent management Execution of due care. 21

22 Vulnerability Assessment Produces Loss impact analysis Financial Operational Critical support areas listing Areas required for business continuity 22

23 Business Impact Assessment Documents a disruptive event s impact. Used to create awareness Impacts may be financial or operational. Note that this is a subset of a vulnerability assessment. 23

24 BIA Primary Goals Prioritize Criticality. Critical business unit processes identified and prioritized. Disruptive event s impact evaluated. Estimate Maximum Tolerable Downtime (MTD) Down time that business can tolerate and still remain viable. Articulate Resource Requirements 24

25 BIA Process Steps 1. Gather needed assessment materials 2. Perform vulnerability assessment 3. Analyze compiled information 4. Document results and present recommendations 25

26 Gathering Assessment Materials Identify which business units are critical to a continuing acceptable level of operations. 26

27 Vulnerability Assessment Similar to Risk Assessment in that there is: An objective Quantitative (financial) section. A subjective Qualitative (operational) section. Differs from RA in that it is smaller. Focuses on providing information solely for BCP/DR. 27

28 Vulnerability Assessment Identify distuption impacts and Maximum Tolerable downtime (MTD) Quantitative or Qualitative Loss projections 28

29 Quantitative Loss Criteria Financial losses: Revenue loss, capital expenditure, personal liability. Resolution of contract agreements violation Resolution of regulatory or compliance requirements violation Additional operational expenses incurred due to the disruptive event 29

30 Qualitative Loss Criteria Loss of: Competitive advantage or market share Public confidence or credibility or incurring public embarrassment. A critical support area is defined as a business unit or function that must be present to sustain continuity or business processes, maintain life safety, or avoid public relations embarrassment. 30

31 Critical Support Areas Telecommunications, data communications or information technology Physical infrastructure or plant facilities, transportation services. Accounting, payroll, transaction processing, customer service, purchasing. 31

32 Analysis Phase Analysis phase includes: Documenting required processes Identifying interdependencies Determining what an acceptable interruption period would be. 32

33 BCP Development Two steps 1. Define continuity strategy 2. Document continuity strategy 33

34 IT Department Identifies company's dependencies Internal and external information. Should ensure that an organization employs: An adequate data backup and restore process Sufficient physical security mechanisms to preserve vital network and hardware components. Sufficient logical security methodologies Implements adequate system administration including up to date hware, sware, and media inventories 34

35 Defining Continuity Strategy Includes elements such as: Computing Facilities People Supplies and equipment 35

36 BCP Approval and Implementation Senior management approval Enterprise wide plan awareness Plan maintenance (updates) 36

37 Disaster Recovery Planning Comprehensive action plan dealing with disruptive events. Primary objectives Implement critical processes at an alternative site. Return to the primary site and normal processing Within time frame that minimizes organizational loss. 37

38 DRP Goals Organized decision methodology for use during a disruptive event. Reduce confusion Minimize decision making during a disaster Can include Protection from major computer services failure Minimize risk from delays in providing services Through testing and simulation, guarantee standby systems reliability 38

39 Disaster Recovery Planning Process Development and creation of the recovery plans (similar to the BCP process). Two steps Data Processing Continuity Planning Data Recovery Plan Maintenance 39

40 Data Processing Continuity Planning Most common alternate processing types Mutual aid agreements aka reciprocal agreement Subscription services Multiple centers Service bureaus Other data center backup alternatives 40

41 Mutual Aid Agreements A mutual aid agreement (sometimes called a reciprocal agreement) is an arrangement with another company that may have similar computing needs. As opposed to a hot or warm site, reciprocal arrangements severely limit the responsiveness and support available to the organization during an event. Can be used only for short term outage support. 41

42 Subscription Services Third party commercial service that provides alternative backup and processing facilities. Three basic forms Hot site Warm site Cold site 42

43 Hot Site A fully configured computer facility with: Electrical power Heating ventilation and air conditioning Functioning file/print servers Workstations. Optimal Most expensive 43

44 Warm Site Readily available computer facility with electrical power, HVAC, and computers. Applications may not be installed or configured. Compared to a hot site: Cheaper More flexible Lower administrative overhead 44

45 Cold Site Site ready for equipment to be brought in. No computer hardware. A room with electrical power and HVAC. Computers must be brought on site Communications links may not be ready. 45

46 Multiple Centers Processing spread across several centers. Managed by same org or with another org (RA) Advantage: Cost Disadvantage: Multiple sites may be damaged 46

47 Service Bureaus In rare cases, an organization may contract with a service bureau for all alternate backup processing services. 47

48 Other Data Center Backup Alternatives Rolling/mobile backup sites In-house or external supply of hardware replacements Prefabricated buildings. 48

49 Transaction Redundancy Implementations Electric vaulting Offsite transfer of backup data via comm. lines Remote journaling Parallel processing of transactions to an alternate site via comm. lines Database shadowing Live processing of remote journaling Creates more redundancy by duplicating database sets to multiple severs. 49

50 Disaster Recovery Plan Maintenance For many different reasons, all recovery plans quickly become obsolete. 50

51 Disaster Recovery Plan Testing A tape backup system cannot be considered working until restoration tests have been conducted Testing: Verifies the recovery procedures accuracy and identifies deficiencies Prepares and trains personnel to execute their emergency duties Verifies the alternate backup site processing capability 51

52 Test Document Document outlining test scenario must contain: Reasons for the test Test objectives Type of test to be conducted. The test s purpose is to find weaknesses in the plan. 52

53 Five Disaster Recovery Plan Test Types Checklist Individual departments review. Structured walk-through Business unit reps meet to walk through the plan Simulation Goes to the point of relocating to alternate backup site or enacting recovery procedures 53

54 Five Disaster Recovery Plan Test Types Parallel Full test of the recovery plan. Full-interruption (live-disaster-test) A disaster is replicated to the point of ceasing normal operations. 54

55 Backup Types Full Backsup everything Incremental Only modified files, achive bit cleared. Fast Differential Only modified files, doesn t clear archive bit. Faster than Full while requiring fewer components than Incremental 55

56 Elements of Disaster Recovery Recovery team Salvage team Normal operations resumption plan Other recovery issues 56

57 Recovery Team When a disaster is declared a clearly defined recovery team has the mandate to implement the recovery procedures. 57

58 Salvage Team A salvage team, separate from the recovery team, returns the primary site to normal processing environmental conditions. Has the mandate to quickly and safely: Clean Repair Salvage After the immediate disaster has ended, determine primary processing infrastructure s viability. 58

59 Normal Operations Resume The steps to resume normal processing operations will be different than the steps in the recovery plan; that is, the least critical work should be brought back first to the primary site. 59

60 Other Recovery Issues Interfacing with external groups Employee relations Fraud and crime Financial disbursement Media relations 60

61 External Groups Often, the organization may be well equipped to cope with a disaster in relation to its own employees, but overlooks its relationship with external parties such as: Police Fire EMS Utility Press 61

62 When is the Disaster Over? When all operations have returned to their normal location and function. 62

63 Other Recovery Issues How does the organization manage its relationship with its employees and their families? In major physical disasters, fraud and crime along with vandalism and looting are common. Procedures for storing signed, authorized checks off site must be considered in order to facilitate financial reimbursement. How does the plan address dealing with the media and with civic officials. 63

64 Questions? 64