Building a Successful Business Continuity Program. Clyde Hague, CISM, CISSP, CRISC Information Security Officer First Merchants Corporation

Transcription

1 Building a Successful Business Continuity Program Clyde Hague, CISM, CISSP, CRISC Information Security Officer First Merchants Corporation

2

3

4 Discussion Topics Breaking Down the Parts Create a Solid Base for Business Continuity Additional Parts that Enhance Sustainability

5 Why Are We Doing This? Five Best Reasons to Invest in Planning *: 1. Understand the real costs of losing data 2. Prevent the risk of business failure 3. Reduce the risk of liabilities and penalties from regulatory compliance 4. Increase employee productivity 5. Gives you peace of mind AMI-Partners - Disaster Recovery Planning : How Planning for a Disaster Can Save Your Business; 2009 HP Development Company, L.P.

6 More Than Computers Can you survive without: employees? electricity? gas? people? Internet? customers? computers?

7 Starting Tips Assign a person or a team to head and sustain the effort. People won t do it unless someone is overseeing it. Determine whether this is a manual process or a computer program is needed. Plan on training and testing your employees at least yearly. Figure out what is really important.

8 Starting Tips Probably the most important tip of all: ESTABLISH COMMUNICATION Establish lines of... Establish heads of Train everyone on

9 Defining Basic Parts of Business Continuity Incident Response Plan Defines what an incident is for your organization Handles an unexpected event that hopefully will be contained and not need the BCP or DR Does not necessarily require BCP activation nor a disaster declaration Should include well-defined severity and declaration criteria, escalation and notification processes Detect, Diagnose/Assess, Manage, Contain/Minimize Effects, Restore, Determine Cause, Implement Improvements

10 Defining Basic Parts of Business Continuity Business Impact Analysis Identifies the resources critical to an organization s continued existence, identifies threats posed to those resources, assess the likelihood of those threats occurring, and the impact of each of those threats on the organization. (Risky Thinking; Everyone knows what order everything will be recovered in. Must be done in a collaborative method Forms the basis for your BCP and DR

11 Defining Basic Parts of Business Continuity Business Continuity Plan A guide for moving through events Not all inclusive Some combine BCP and Disaster Recovery; some keep separate Based on a Business Impact Analysis Includes: Specific steps you want employees to follow and who is responsible Contact information/call trees very important Unique documents for different disciplines

12 Defining Basic Parts of Business Continuity Disaster Recovery Plan Again, some combine with BCP while others separate Based on Business Impact Analysis An incident can become a disaster either by mishandling or by natural progression of the incident Directs the recovery of resources and systems by people while a BCP directs the actions of people to continue the business

13 Testing Your Plans Update and Testing Plans should be updated periodically at set times Incident Response Plans should be tested continually with live real incidents Test the applicability and usability of the business continuity plan Table top testing with documented scenarios is effective Test for disaster restoration of critical infrastructure and business applications Act on lessons learned Post Event Review

14 Create a Solid Base Supporting policies, standards and procedures must be in place Train all appropriate personnel Ensure communication channels are established and functioning Monitoring for incidents the timing and reaction can make all the difference

15 Additional Parts Remote Access for employees Citrix CAG is an example Allows for higher productivity during an event If recovery site is far away, remote access saves money by limiting travel to necessary employees Employees are happier as they stay at or near their homes Put in place before an event Incorporate in normal work processes - Train and Practice Consider pairing it with Out of Band Authentication or other log on security

16 Additional Parts A Mature Vendor Management Program Do your contracts and agreement provide for your needs during an event? Are your critical vendors and suppliers in your BCP? Do your critical vendors have tested BCP/DR s in place? What about Cloud Computing? Remember Amazon EC2.

17 Additional Parts An involved emergency response team Paper plans at home or car and at work A user base that communicates events Consider Addendums to Your BCP for Specific Situations Pandemic Plan Severe Weather Procedure

18 Final Tip If you are backing up your systems (great!) but the back up stays on site, stop and move your backups offsite. If you don t like the idea of not having a backup onsite, make duplicates and put one off site at a secure facility or back it up remotely in a secure manner to a secure facility.

19 Online Help Some Business Continuity Sites on the Internet (not a recommendation, just FYI): Disasterrecoveryplantemplate.org Searchdisasterrecovery.techtarget.com Searchsmbstorage.techtarget.com Ready.gov/business/implementation/continuity (part of FEMA) Finra.org/industry/issues/businesscontinuity/p

20 Questions? Thank you for your time! Clyde Hague, CISM, CISSP, CRISC Information Security Officer First Merchants Corporation