SECURITY SUMMIT 2014: EVOLUZIONE DELLA BUSINESS CONTINUITY E RUOLO DEL DISASTER RECOVERY

Transcription

1 SECURITY SUMMIT 2014: EVOLUZIONE DELLA BUSINESS CONTINUITY E RUOLO DEL DISASTER RECOVERY 20 March 2014 Corradino Corradi Vodafone Italy Head of ICT Security & Fraud Management

2 Business Continuity vs. Disaster Recovery: Two professions looking for connections BC Manager D/R Manager Risk oriented Focus on all processes and critical activities (business resilience) RTO/RPO as operational indicator Report to CRO or Corporate Security Technology oriented Focus on information protection (IT & Network uptime) Service catalogue (SLA) and daily system downtime (availability 99.99%) Report to CTO or CIO New governance From contrast to confrontation and active cooperation

3 BCM responsibilities Worldwide statistics C-level executive with ultimate reporting responsibility BCM Program Leader Job title of the executive sponsor for organization s BCM programs Job title of the BCM program sponsor Source: Continuity Insights & KPMG LLP Global BCM Program Benchmarking Study

4 BCM responsibilities Italian scenario Is BCM managed internally or externally? When BC is managed internally, who does the BC manager report to? Externally 21% Internally 79% 24% 28% 48% ICT Manager CEO/Managing Dir. Other Source: ASIS and AIPSA surveys

5 Top 10 operational risks (2013) 1. IT sabotage 2. Reputational damage 3. Incentives and compensation 4. Fraud and customer data abuse 5. Epidemic disease 6. Political intervention 7. Sanctions and AML compliance 8. Emerging market operating risks 9. Business continuity and disaster recovery Source: IT matters and plays a critical role in the definition of the public and private enterprises Business Continuity plans

6 Top 10 Infrastructure Issues that CIOs need to include in IT Strategy 1. Users will not be centrally located The day of a central office that controls the ebb and flow of information from the field is gone 2. Users can be anywhere in the world As business branch out and the global economy takes over the infrastructure will have to address access and control from multiple locations 3. The work day no longer is 9 to 5 As more users are in different time zones responses for things like service centers will need to be 7 by Holidays and week-ends do not matter In much of the world the weekend as we know it in the US is not the same and Thanksgiving and Christmas are not celebrated around the world. 5. The language barrier needs to be crossed When someone who does not speak English interacts with the infrastructure it must be adaptable to meet their needs in their local language 6. Applications need to be mobile Smartphones and tablets are taking over the world of computing and applications need to be available to them 7. Security and privacy need to be balanced with the needs of everyone in the product service chain of the enterprise 8. Compliance will only become more complex Not only do applications and data need to comply with local legislation but the infrastructure needs to be able to adjust to new more demanding and diverse requirements 9. Data capture and dissemination need to be productive Data need to be captured once (accurately) and then harnessed so that the infrastructure can leverage it productively 10. Business never stops and the Business Continuity and Disaster Recovery plans need to keep that in mind Source: Janco Associates. Inc.

7 10 Business Continuity Predictions for getting to grips with Business Resilience 1. Business Resilience we ll see the move from an academic discussion to one more practical; the debate will continue as to whether this is a rebranding exercise or a substantive change. 2. Security, risk and business continuity professionals will continue to look at synergies while recognizing that each discipline actually deals with different challenges. 3. IT will still dominate BC thinking but refreshed under the cyber threat, big data, cloud and mobility services. The cyber threat will start to move on from its hype phase to a more sophisticated, nuanced understanding. 4. Contingency planning will become fashionable again as part of a broader understanding of Business Continuity which includes continuity capability and crisis response. 5. ISO 22301, the new international Business Continuity Management standard, will start to take-off with certificates issued in more than one country. 6. Regulators will question whether the answer to resilience is more regulation; alternative, market-driven methods will be explored. 7. There will be some high profile business continuity failures, where the actual Business Continuity Management team will not be involved at all. Discussions on extending Business Continuity concepts more broadly will still be a minority activity. 8. Sustainability as a driver for Business Continuity will still be in the wings, waiting for its call onto the stage. 9. Service failures by outsourcers will put continued pressure on globalised service delivery models that don t consider resilience. Business Continuity professionals will need to get the economic case for Business Continuity on the table. 10. Social media will continue to present both a challenge and opportunity for business continuity professionals, as it provides opportunities for early visibility of issues and effective crisis communications, while equally being a source of misinformation and a medium to fan the flames of a crisis. Source: The BC Eye

8 Gartner: the Nexus of Forces Changes Everything IT, Business, Society

9 Business Continuity vs. Disaster Recovery Interest through time... Parted means losing! Trend Italia * ** Business Continuity Disaster Recovery Crisis Management Source: Google * 31/12/2006: deadline applicazione Direttiva Banca d Italia "Continuità operativa in casi di emergenza ** Incidente Costa Concordia Resource and/or workload constraints (35%) whenever possible, combine the skills and forces of BC and D/R mangers Planning and anticipation (33%) regulation is not necessarily bad

10 Conclusions Need for greater dialogue between the BC Managers and D/R Managers Need for renewed governance mechanisms (committees, working groups) promoting integration and dialogue Shared managerial and operational performance goals to "row in the same direction Joint adoption of international standards (e.g. ITIL, ISO 22301) to facilitate standardization and homogenization of projects, including the information management ones supporting the business, is a MUST both for Business Continuity Manager and Disaster Recovery Managers

11 Q & A