Incident Management, Business Continuity and IT Disaster Recovery
|
|
- Alban Johnson
- 7 years ago
- Views:
Transcription
1 Incident Management, Business Continuity and IT Disaster Recovery Aggeliki Tsohou Lecturer, Ionian University, Department of Informatics, Greece 1
2 Contents Information Security Incident Management Terminology Business Continuity Management Terminology Business Continuity facts and practices Case study presentation 2
3 Terminology Incident: Situation that might be, or could lead to, a business disruption, loss, emergency or crisis Information Security Incident: Single or a series of unwanted or unexpected information security events that have a significant probability of compromising business operations and threatening information security Information Security Event: identified occurrence of a system, service or network state indicating a possible breach of information security, policy or failure of controls, or a previously unknown situation that may be security relevant 3
4 Terminology Information Security Incident Management: processes for detecting, reporting, assessing, responding to, dealing with, and learning from information security incidents Information Security Incident Response Team: a team of appropriately skilled and trusted members of the organization, which will handle information security incidents during their lifecycle. At times this team may be supplemented by external experts, for example from a recognized computer incident response team or Computer Emergency Response Team (CERT) 4
5 Background Risk management, operational security, forensics, awareness and training, compliance monitoring are some of the key information security priorities of organizations Ernst & Young (2013), Under cyber attack EY s Global Information Security Survey 2013 Increasing number of security incidents, which constantly grows; from 3.4 million reported incidents per year in 2009 to 42.8 million in 2014 PricewaterhouseCoopers, Managing cyber risks in an interconnected world Key findings from The Global State of Information Security Survey
6 Examples of Information Security Incidents Denial of Service Incidents: resource elimination and resource starvation Information Gathering Incidents By technical means: e.g., pinging network addresses to find systems that are alive, scanning the available network ports on a system to identify the related services (e.g. , FTP, Web, etc.) and the software version of those services By non-technical means: e.g., theft of intellectual property stored electronically, misuse of information systems Unauthorized Access: e.g., buffer overflow attacks to attempt to gain privileged access to a target, attempts to retrieve password files, etc. 6
7 Incident Management as part of an ISMS (ISO 27001) Objective: To ensure a consistent and effective approach to the management of information security incident including communication on security events and weaknesses Controls: Management responsibilities and procedures should be established to ensure a quick, effective and orderly response to information security incidents Information security events should be reported through appropriate management channels as quickly as possible Employees and contractors using the organization s information systems and services should be required to note and report any observed or suspected information security weaknesses in systems or services 7
8 Incident Management as part of an ISMS (ISO 27001) Objective: To ensure a consistent and effective approach to the management of information security incident including communication on security events and weaknesses Controls: Information security events should be assessed and it should be decided if they are to be classified as information security incidents Information security incidents should be responded to in accordance with the documented procedures Knowledge gained from analysing and resolving information security incidents should be used to reduce the likelihood or impact of future incidents The organization should define and apply procedures for the identification, collection, acquisition and preservation of information, which can serve as evidence 8
9 Information Security Incident Management Plan and Prepare Improve Use Review 9
10 Plan & Prepare Information security incident management policy, and commitment of senior management Develop and Document an Information security incident management scheme Update of all corporate, system, service, network security policies ISIRT establishment with defined roles and responsibilities Information security incident management awareness briefings and training Information security incident management scheme testing 10
11 Use Information security event detection and reporting by human or automatic means Collection of information on information security events and assessment and decision the criteria to determine what events are to be categorized as information security incidents Responses to information security incident, including: Real-time or in near real-time Crisis activities and activation of business continuity Forensic analysis Logging Resolution 11
12 Review Further forensic analysis Identification of lessons learnt from incidents Identification of improvements to security Identification of improvements to information security incident management scheme 12
13 Improve Make improvements to security risk analysis and management review results Initiate improvements to security Make improvements to information security incident management scheme 13
14 14
15 15
16 Benefits Reducing adverse business impacts, for example disruption and financial loss, caused as a consequence of information security incidents Strengthening the information security incident prevention focus Strengthening of prioritization and evidence Contributing to budget and resource justifications Improving updates to risk analysis and management results Providing enhanced information security awareness and training program material Providing input to information security policy and related documentation reviews 16
17 Terminology Business Continuity: Strategic and tactical capability of the organization to plan for and respond to incidents and business disruptions in order to continue business operations at an acceptable pre-defined level 17
18 Terminology Business Continuity Management (BCM): holistic management process that, identifies potential threats to an organization and the impacts to business operations that those threats, if realized, might cause, and provides a framework for building organizational resilience with the capability for an effective response that safeguards the interests of its key stakeholders, reputation, brand and value-creating activities 18
19 Terminology Business Continuity Plan: Documented collection of procedures and information that is developed, compiled and maintained in readiness for use in an incident to enable an organization to continue to deliver its critical activities at an acceptable pre-defined level 19
20 BCM is complementary to risk management Risk management helps understanding the risks to operations or business, and the consequences of those risks. BCM helps recognizing what needs to be done before an incident occurs to protect its people, premises, technology, information, supply chain, stakeholders and reputation when the incident happens. BCM helps taking a realistic view on the responses that are likely to be needed when a incident occurs, so that the organization can be confident that it will manage through any consequences 20
21 Incident Timeline 21 BS :2006
22 BCM lifecycle and its elements 22 BS :2006
23 BCM lifecycle and its elements BCM programme management: enables the business continuity capability to be both established and maintained in a manner appropriate to the size and complexity of the organization. Understanding the organization: provides information that enables prioritization of an organization s products and services and the urgency of the activities that are required to deliver them. Business Impact Analysis is the core process of this phase. Determining BCM strategy: allows an appropriate response to be chosen for each product or service, such that the organization can continue to deliver those products and services: at an acceptable level of operation, and within an acceptable timeframe during and following a disruption. 23
24 BCM lifecycle and its elements Developing and implementing a BCM response: creation of a management framework and a structure of incident management, business continuity and business recovery plans that detail the steps to be taken during and after an incident to maintain or restore operations BCM exercising, maintaining and reviewing: Demonstrating the extent to which its strategies and plans are complete, current and accurate and identifying opportunities for improvement. Embedding BCM in the organization s culture: making BCM part of the organization s core values and instilling confidence in all stakeholders in the ability of the organization to cope with disruptions 24
25 Business Impact Analysis Identification of the activities, assets and resources, including those outside the organization, that support the delivery of the fundamental products and services Identification of interdependencies of its activities Identification of any reliance on external organizations, and any reliance placed upon it by other organizations 25
26 Business Impact Analysis For each activity: establish the maximum tolerable period of disruption by identifying: the maximum time period after the start of a disruption within which the activity needs to be resumed (recovery time objective), the minimum level at which the activity needs to be performed on its resumption, the length of time within which normal levels of operation need to be resumed (maximum tolerable downtime); identify any inter-dependent activities, assets, supporting infrastructure or resources that have also to be maintained continuously or recovered over time 26
27 IT Disaster Recovery Information Technology (IT) is essential to most organizations and very few can operate for anything other than a short period of time without computer support IT disaster recovery is the process by which IT and associated infrastructure is recovered following a disruption to services An IT disaster recovery solution is decided based on two main parameters: A recovery point objective A recovery time objective, which should be less than the maximum tolerable downtime 27
28 IT Disaster Recovery Facilities Cold Sites: facilities with adequate space and infrastructure (electric power, telecommunications connections, and environmental controls) to support information system recovery activities Warm Sites: partially equipped office spaces that contain some or all of the system hardware, software, telecommunications, and power sources Hot Sites: facilities appropriately sized to support system requirements and configured with the necessary system hardware, supporting infrastructure, and support personnel Mobile Sites: self-contained, transportable shells custom-fitted with specific telecommunications and system equipment necessary to meet system requirements Mirrored Sites: fully redundant facilities with automated real-time information mirroring. Mirrored sites are identical to the primary site in all technical respects 28
29 IT Disaster Recovery Facilities Site Cost H/W Telecommunication Time Location Cold Low None None Long Fixed Warm Medium Partial Partial/Full Medium Fixed Hot Medium/ High Full Full Short Fixed Mobile High Depend s Depends Depends Mobile Mirrored High Full Full Zero Fixed 29
30 Trade off between cost and time (illustrative) 30
31 IT Disaster Recovery Strategies Infrastructure Considerations: Organization being the owner Organization renting facilities Back-up Considerations: Frequency Location Labeling Storage media Media disposal processes Transportation means 31
32 IT Disaster Recovery Strategies Hardware Considerations: Agreements with suppliers Hardware inventory Re-use of existing compatible hardware People Considerations: Recovery groups Hierarchy of people and groups 32
33 Program Exercise Assurance that the Business Continuity and IT Disaster Recover plans will work as anticipated when required, through: exercising the technical, logistical, administrative, procedural and other operational systems of the plans exercising the plan arrangements (e.g. roles, responsibilities) and infrastructure (e.g. locations) exercising the technology and telecommunications recovery, including the availability and relocation of staff verifying that the business continuity plan incorporates all critical activities and their dependencies validating the effectiveness and timeliness of restoration of critical activities 33
34 Maintenance of plans Regular review of: Business activities and their criticality Interdependencies Hardware and software that supports activities Names and contact details of recovery groups Names and contact details of suppliers Recovery facilities 34
35 Recent challenges and trends (Ernst and Young, 2012 Global Information Security Survey) Studies show that two out of five businesses that experience a disaster go out of business within five years 35
36 Recent challenges and trends (Ernst and Young, 2012 Global Information Security Survey) 17% of the respondents said that their organizations do not have a BCM program in place, Of the organizations that do have a BCM program only 25% believe that their programs reflect a leading practice approved by senior management with defined standards and guidelines, roles and responsibilities and tools and techniques 36
37 Recent challenges and trends (Ernst and Young, 2012 Global Information Security Survey) The most common problem with BCM programs is the lack of governance integration between business continuity and IT disaster recovery Other challenges: Lack of senior management support Unclear roles and responsibilities Conflicting priorities of the business Ineffective coordination between the business and IT Constant changes in the business and in IT 37
38 Recent challenges and trends (Ernst and Young, 2012 Global Information Security Survey) Problems indicating lack of integration between business continuity and IT disaster recovery: Business owners assuming that IT backs up all information and can quickly and successfully recover it after an interruption IT teams implementing a recovery solution that does not meet the needs of a business Top management rejecting IT s requests for disaster recovery funding IT teams not informing management and other personnel about the interdependencies of the critical systems and applications No consideration of the ramifications if people are not available to support IT systems and business processes 38
39 Statistics about the question : Which of the following applies to your BCM strategy? 39
40 Issues noticed by practitioners It is difficult to make a business continuity plans that cover the whole organization Business continuity plans may be designed but never used in reality Business continuity plans may be designed but never updated Business continuity plans may be designed but never tested and exercised Upon an incident, older versions of the plans may be used instead of the current ones After an incident no lessons learnt may not be documented 40
41 Issues noticed by practitioners It might be difficult to predict a case although an organization should be prepared for, because the incident might be something completely new, e.g. the Stuxnet cyberweapon Estonia s cyberattacks It is not always easy to predict severe impacts, such as reputation damage due to IT security incidents, e.g. The Edward Snowden case in the US which caused severe reputation impacts due to information leakage (The extent of the leaks may never be known according to US investigators) The Finnish Ministry of Foreign Affair cyber attack 41
42 Academic and practical problems Confusion in the terminology used in organizations and the literature: Disaster recovery planning, Incident response planning, Business continuity planning, Incident management response, Business impact analysis, Vulnerability assessment, Contingency planning, Crisis management planning, IT preparedness, Security incident management Business Continuity Plan, Business Recovery Plan, Continuity of Operations Plan, IT Contingency Plan, Crisis Communication Plan, Cyber Incident Response Plan, Disaster Recovery Plan, Occupant Emergency Plan 42
43 Academic research Few studies that exist are conceptual or only descriptive of empirical data by interviews or case studies. Examples: Rodrigo Werlinger, Kasia Muldner, Kirstie Hawkey, Konstantin Beznosov, (2010) "Preparation, detection, and analysis: the diagnostic work of IT security incident response", Information Management & Computer Security, 18 (1), Omar, A., Alijani, D, Mason, R,(2011), Information Technology Disaster Recovery Plan: Case Study, Academy of Strategic Management Journal, 10 (2), Al-Badi A, Ashrafi R, Al-Majeeni A, Mayhew P, (2009) "IT disaster recovery: Oman and Cyclone Gonu lessons learned", Information Management & Computer Security, 17 (2),
44 Academic research 44 Nijaz Bajgoric, (2006), Information technologies for business continuity: an implementation framework", Information Management & Computer Security, 14, 5, pp
45 Academic research Under investigated research area Interdisciplinary nature with unclear boundaries Difficulty of access to empirical data about real security incidents and how they were handled 45
46 CASE 46
47 Case: The Hospital According to the hospital management the maximum tolerance period is 2 week According to our analysis the maximum tolerance period was 1 week 47
48 Case: The Hospital The disaster recovery planning method followed: Context establishment Impact analysis Identification of threats Identification of impacts Identification of requirements for recovery Disaster recovery planning 48
49 Context establishment 1 Server hosting the Document Management application 1 Server hosting the Blood Results application 1 Server hosting the Human Resources and Payroll application 1 Server hosting the Patients Management application and the Logistics application 1 webserver The Document Management application The Blood Results application The Human Resources and Payroll application The Patients Management application The Logistics application The MS Office 49
50 Impact analysis The leading question for developing the security plan was which threats are more probable? The leading question for developing the disaster recovery plan was which threats have the most severe impact? and especially can lead to total loss of the system. 50
51 Impactanalysis Terrorism Fire Earthquake Wilful damage Theft by outsiders Threats which may lead to partial and total loss of data (threats with High or Very high probability): Masquerading by Insiders Masquerading by Outsiders 51
52 Disaster Recovery planning Back processes: Three generations of back-ups First: every day, only data, same physical location Second: total back-up, weekly, taken on Sunday and loading on Monday morning, stored outside the facilities Third: annual back-up, stored for every year and kept outside the facilities Roles: Group for Personnel safety Group for Disaster Recovery plan execution 52
53 Disaster Recovery planning Training for the plan execution Annual full rehearsal Back-ups will be stored at fire-protective cabinets, with at least 30 minutes tolerance Warm Disaster Recovery site: At least 3 servers Telecommunications Alarm Hardware maintenance contract with: Maximum 1 week for replacement in case of disaster 53
54 References ISO/IEC TR 18044:2004 Information technology -- Security techniques -- Information security incident management BS :2007, Business continuity management -- Code of Practice, British Standards 54
INFORMATION SECURITY INCIDENT MANAGEMENT PROCESS
INFORMATION SECURITY INCIDENT MANAGEMENT PROCESS Effective Date June 9, 2014 INFORMATION SECURITY INCIDENT MANAGEMENT PROCESS OF THE HELLER SCHOOL FOR SOCIAL POLICY AND MANAGEMENT Table of Contents 1.
More informationBusiness Continuity Planning and Disaster Recovery Planning
4 Business Continuity Planning and Disaster Recovery Planning Basic Concepts 1. Business Continuity Management: Business Continuity means maintaining the uninterrupted availability of all key business
More informationCompany Management System. Business Continuity in SIA
Company Management System Business Continuity in SIA Document code: Classification: Company Project/Service Year Document No. Version Public INDEX 1. INTRODUCTION... 3 2. SIA S BUSINESS CONTINUITY MANAGEMENT
More informationProposal for Business Continuity Plan and Management Review 6 August 2008
Proposal for Business Continuity Plan and Management Review 6 August 2008 2008/8/6 Contents About Newton IT / Quality of our services. BCM & BS25999 Overview 2. BCM Development in line with BS25999 3.
More informationOhio Supercomputer Center
Ohio Supercomputer Center IT Business Continuity Planning No: Effective: OSC-13 06/02/2009 Issued By: Kevin Wohlever Director of Supercomputer Operations Published By: Ohio Supercomputer Center Original
More informationBy. Mr. Chomnaphas Tangsook Business Director BSI Group ( Thailand) Co., Ltd
BS 25999 Business Continuity Management By. Mr. Chomnaphas Tangsook Business Director BSI Group ( Thailand) Co., Ltd 1 Contents slide BSI British Standards 2006 BS 25999(Business Continuity) 2002 BS 15000
More informationISO 27001 Controls and Objectives
ISO 27001 s and Objectives A.5 Security policy A.5.1 Information security policy Objective: To provide management direction and support for information security in accordance with business requirements
More informationBCP and DR. P K Patel AGM, MoF
BCP and DR P K Patel AGM, MoF Key difference between BS 25999 and ISO 22301 ISO 22301 puts a much greater emphasis on setting the objectives, monitoring performance and metrics aligning BC to top management
More informationBusiness Continuity Management Framework 2014 2017
Business Continuity Management Framework 2014 2017 Blackpool Council Business Continuity Framework V3.0 Page 1 of 13 CONTENTS 1.0 Forward 03 2.0 Administration 04 3.0 Policy 05 4.0 Business Continuity
More informationSolihull Clinical Commissioning Group
Solihull Clinical Commissioning Group Business Continuity Policy Version v1 Ratified by SMT Date ratified 24 February 2014 Name of originator / author CSU Corporate Services Review date Annual Target audience
More informationBSO Board Director of Human Resources & Corporate Services Business Continuity Policy. 28 February 2012
To: From: Subject: Status: Date of Meeting: BSO Board Director of Human Resources & Corporate Services Business Continuity Policy For Approval 28 February 2012 The Board is asked to agree the attached
More informationDomain 1 The Process of Auditing Information Systems
Certified Information Systems Auditor (CISA ) Certification Course Description Our 5-day ISACA Certified Information Systems Auditor (CISA) training course equips information professionals with the knowledge
More informationCENTRAL BANK OF KENYA (CBK) PRUDENTIAL GUIDELINE ON BUSINESS CONTINUITY MANAGEMENT (BCM) FOR INSTITUTIONS LICENSED UNDER THE BANKING ACT
CENTRAL BANK OF KENYA (CBK) PRUDENTIAL GUIDELINE ON BUSINESS CONTINUITY MANAGEMENT (BCM) FOR INSTITUTIONS LICENSED UNDER THE BANKING ACT JANUARY 2008 GUIDELINE ON BUSINESS CONTINUITY GUIDELINE CBK/PG/14
More informationISO27001 Controls and Objectives
Introduction This reference document for the University of Birmingham lists the control objectives, specific controls and background information, as given in Annex A to ISO/IEC 27001:2005. As such, the
More informationINFORMATION TECHNOLOGY SECURITY STANDARDS
INFORMATION TECHNOLOGY SECURITY STANDARDS Version 2.0 December 2013 Table of Contents 1 OVERVIEW 3 2 SCOPE 4 3 STRUCTURE 5 4 ASSET MANAGEMENT 6 5 HUMAN RESOURCES SECURITY 7 6 PHYSICAL AND ENVIRONMENTAL
More informationPost-Class Quiz: Business Continuity & Disaster Recovery Planning Domain
1. What is the most common planned performance duration for a continuity of operations plan (COOP)? A. 30 days B. 60 days C. 90 days D. It depends on the severity of a disaster. 2. What is the business
More informationWith the large number of. How to Avoid Disaster: RIM s Crucial Role in Business Continuity Planning. Virginia A. Jones, CRM, FAI RIM FUNDAMENTALS
How to Avoid Disaster: RIM s Crucial Role in Business Continuity Planning The world has experienced a great deal of natural and man-made upheaval and destruction in the past few years, including tornadoes,
More informationNORTH HAMPSHIRE CLINICAL COMMISSIONING GROUP BUSINESS CONTINUITY MANAGEMENT POLICY AND PLAN (COR/017/V1.00)
NORTH HAMPSHIRE CLINICAL COMMISSIONING GROUP BUSINESS CONTINUITY MANAGEMENT POLICY AND PLAN (COR/017/V1.00) Subject and version number of document: Serial Number: Business Continuity Management Policy
More informationDesktop Scenario Self Assessment Exercise Page 1
Page 1 Neil Jarvis Head of IT Security & IT Risk DHL Page 2 From reputation to data loss - how important is business continuity? Neil Jarvis Head of IT Security (EMEA) DHL Logistics IT Security Taking
More informationBusiness Continuity Management and BS 25999 by Steve Chan, Head of Training - HK, BSI Management Systems
Business Continuity Management and BS 25999 by Steve Chan, Head of Training - HK, BSI Management Systems 9 April, 2008 2 Presentation content Drivers for Business Continuity Standards and definitions.
More informationShankar Gawade VP IT INFRASTRUCTURE ENAM SECURITIES PVT. LTD.
Business Continuity Management & Disaster Recovery Planning Presented by: Shankar Gawade VP IT INFRASTRUCTURE ENAM SECURITIES PVT. LTD. 1 What is Business Continuity Management? Is a holistic management
More informationBusiness Continuity and Disaster Recovery Planning
Business Continuity and Disaster Recovery Planning Jennifer Brandt, CISA A p r i l 16, 2015 HISTORY OF STINNETT & ASSOCIATES Stinnett & Associates (Stinnett) is a professional advisory firm offering services
More informationD2-02_01 Disaster Recovery in the modern EPU
CONSEIL INTERNATIONAL DES GRANDS RESEAUX ELECTRIQUES INTERNATIONAL COUNCIL ON LARGE ELECTRIC SYSTEMS http:d2cigre.org STUDY COMMITTEE D2 INFORMATION SYSTEMS AND TELECOMMUNICATION 2015 Colloquium October
More informationNHS ISLE OF WIGHT CLINICAL COMMISSIONING GROUP BUSINESS CONTINUITY POLICY
NHS ISLE OF WIGHT CLINICAL COMMISSIONING GROUP BUSINESS CONTINUITY POLICY AUTHOR/ APPROVAL DETAILS Document Author Written By: Human Resources Authorised Signature Authorised By: Helen Shields Date: 20
More informationIT Security Incident Management Policies and Practices
IT Security Incident Management Policies and Practices Information Technology Services Center (ITSC) of The Hong Kong University of Science and Technology Date: Feb 6, 2015 i Document Control Document
More informationPAPER-6 PART-1 OF 5 CA A.RAFEQ, FCA
1 Chapter-4: Business Continuity Planning and Disaster Recovery Planning PAPER-6 PART-1 OF 5 CA A.RAFEQ, FCA Learning Objectives 2 To understand the concept of Business Continuity Management To understand
More informationBirmingham CrossCity Clinical Commissioning Group. Business Continuity Management Policy
Birmingham CrossCity Clinical Commissioning Group Business Continuity Management Policy Version V1.0 Ratified by Operational Development Group Date ratified 6 th November 2014 Name of originator / author
More informationCISM Certified Information Security Manager
CISM Certified Information Security Manager Firebrand Custom Designed Courseware Chapter 4 Information Security Incident Management Exam Relevance Ensure that the CISM candidate Establish an effective
More informationBS 25999 BUSINESS CONTINUITY MANAGEMENT
BS 25999 BUSINESS CONTINUITY MANAGEMENT AUDIT, CERTIFICATION & training services HOW CAN YOU ENSURE BUSINESS CONTINUITY? BS 25999 AUDITS & CERTIFICATION FROM SGS Most organisations will, at some point,
More informationIl nuovo standard ISO 22301 sulla Business Continuity Scenari ed opportunità
Il nuovo standard ISO 22301 sulla Business Continuity Scenari ed opportunità Massimo Cacciotti Business Services Manager BSI Group Italia Agenda BSI: Introduction 1. Why we need BCM? 2. Benefits of BCM
More informationBusiness Continuity. Is your Business Prepared for the worse? What is Business Continuity? Why use a Business Continuity Plan?
Business Continuity Is your Business Prepared for the worse? Major emergencies can develop suddenly without warning. Situations can threaten and disrupt your business and impact upon you and your staff.
More informationEmergency Response and Business Continuity Management Policy
Emergency Response and Business Continuity Management Policy Owner: John Duffy, Registrar & Secretary Last updated: September 2012 Version: 04 Document control Date Version Author Changes To be populated
More informationWEST LOTHIAN COUNCIL INFORMATION SECURITY POLICY
WEST LOTHIAN COUNCIL INFORMATION SECURITY POLICY DATA LABEL: PUBLIC INFORMATION SECURITY POLICY CONTENTS 1. INTRODUCTION... 3 2. MAIN OBJECTIVES... 3 3. LEGISLATION... 4 4. SCOPE... 4 5. STANDARDS... 4
More informationBusiness Continuity Policy and Business Continuity Management System
Business Continuity Policy and Business Continuity Management System Summary: This policy sets out the structure for ensuring that the PCT has effective Business Continuity Plans in place in order to maintain
More informationCyber Security Incident Handling Policy. Information Technology Services Center (ITSC) of The Hong Kong University of Science and Technology
Cyber Security Incident Handling Policy Information Technology Services Center (ITSC) of The Hong Kong University of Science and Technology Date: Oct 9, 2015 i Document Control Document Owner Classification
More informationTable of Contents... 1
... 1 Chapter 1 Introduction... 4 1.1 Executive Summary... 4 1.2 Goals and Objectives... 5 1.3 Senior Management and Board of Directors Responsibilities... 5 1.4 Business Continuity Planning Processes...
More informationTemple university. Auditing a business continuity management BCM. November, 2015
Temple university Auditing a business continuity management BCM November, 2015 Auditing BCM Agenda 1. Introduction 2. Definitions 3. Standards 4. BCM key elements IT Governance class - IT audit program
More informationPAPER-6 PART-3 OF 5 CA A.RAFEQ, FCA
Chapter-4: Business Continuity Planning and Disaster Recovery Planning PAPER-6 PART-3 OF 5 CA A.RAFEQ, FCA Learning Objectives 2 To understand the concept of Business Continuity Management To understand
More informationChapter I: Fundamentals of Business Continuity Management
Chapter I: Fundamentals of Business Continuity Management Objectives Define Business Continuity Management (BCM) Define the relationship between BCM and risk management Review BCM responsibilities Identify
More information16) INFORMATION SECURITY INCIDENT MANAGEMENT
Ing. Ondřej Ševeček GOPAS a.s. MCM: Directory Services MVP: Enterprise Security CHFI: Computer Hacking Forensic Investigator CISA CEH: Certified Ethical Hacker ondrej@sevecek.com www.sevecek.com 16) INFORMATION
More informationBUSINESS CONTINUITY MANAGEMENT POLICY
BUSINESS CONTINUITY MANAGEMENT POLICY AUTHORISED BY: DATE: Andy Buck Chief Executive March 2011 Ratifying Committee: NHS Rotherham Board Date Agreed: Issue No: NEXT REVIEW DATE: 2013 1 Lead Director John
More informationDisaster Recovery Planning Procedures and Guidelines
Disaster Recovery Planning Procedures and Guidelines A Mandatory Reference for ADS Chapter 545 New Reference: 06/01/2006 Responsible Office: M/DCIO File Name: 545mal_060106_cd44 Information System Security
More informationISO/IEC 27002:2013 WHITEPAPER. When Recognition Matters
When Recognition Matters WHITEPAPER ISO/IEC 27002:2013 INFORMATION TECHNOLOGY - SECURITY TECHNIQUES CODE OF PRACTICE FOR INFORMATION SECURITY CONTROLS www.pecb.com CONTENT 3 4 5 6 6 7 7 7 7 8 8 8 9 9 9
More informationBusiness Continuity Management Policy
Business Continuity Management Policy Business Continuity Policy Version 1.0 1 Version control Version Date Changes Author 0.1 April 13 1 st draft PH 0.2 June 13 Amendments in line with guidance PH 0.3
More informationBusiness Continuity Planning and Disaster Recovery Planning. Ed Crowley IAM/IEM
Business Continuity Planning and Disaster Recovery Planning Ed Crowley IAM/IEM 1 Goals Compare and contrast aspects of business continuity Execute disaster recovery plans and procedures 2 Topics Business
More informationHOW CAN YOU ENSURE BUSINESS CONTINUITY? ISO 22301 AUDITS, CERTIFICATION AND TRAINING
HOW CAN YOU ENSURE BUSINESS CONTINUITY? ISO 22301 AUDITS, CERTIFICATION AND TRAINING ISO 22301 BUSINESS CONTINUITY MANAGEMENT SYSTEMS Most organisations will, at some point, be faced with having to respond
More informationwww.td.com.au Business Continuity - IT Disaster Recovery Discussion Paper - - Commercial in Confidence Version V2.0R Wednesday, 5 September 2012
Business Continuity - IT Disaster Recovery Discussion Paper - - Version V2.0R Wednesday, 5 September 2012 Commercial in Confidence Melbourne Sydney 79-81 Coppin St Level 2 Richmond VIC 3121 414 Kent St
More informationISO 27002:2013 Version Change Summary
Information Shield www.informationshield.com 888.641.0500 sales@informationshield.com Information Security Policies Made Easy ISO 27002:2013 Version Change Summary This table highlights the control category
More informationSuccess or Failure? Your Keys to Business Continuity Planning. An Ingenuity Whitepaper
Success or Failure? Your Keys to Business Continuity Planning An Ingenuity Whitepaper May 2006 Overview With the level of uncertainty in our world regarding events that can disrupt the operation of an
More informationINFOSEC.MY KNOWLEDGE SHARING SESSION
INFOSEC.MY KNOWLEDGE SHARING SESSION Integration BCM into your Organization: Challenges & Opportunities 31 st October 2007 1 Prabha Ramanathan ( CBCP, MBCI, MBCS, MSCS) Certified Business Continuity Professional.have
More informationwww.pwc.com Business Resiliency Business Continuity Management - January 14, 2014
www.pwc.com Business Resiliency Business Continuity Management - January 14, 2014 Agenda Key Definitions Risks Business Continuity Management Program BCM Capability Assessment Process BCM Value Proposition
More informationNOT PROTECTIVELY MARKED BUSINESS CONTINUITY. Specialist Operations Contingency Planning Business Continuity Manager 17.09.12
POLICY BUSINESS CONTINUITY Policy owners Policy holder Author Head of Services Specialist Operations Contingency Planning Business Continuity Manager Policy No. 132 Approved by Legal Services 17.09.12
More informationOVERVIEW. In all, this report makes recommendations in 14 areas, such as. Page iii
The Office of the Auditor General has conducted a procedural review of the State Data Center (Data Center), a part of the Arizona Strategic Enterprise Technology (ASET) Division within the Arizona Department
More informationBusiness Continuity Policy
Business Continuity Policy Software, consultancy and services for global trade and supply chain management Business Continuity Policy Companies using AEB solutions for managing and monitoring their logistics
More informationNHS Central Manchester Clinical Commissioning Group (CCG) Business Continuity Management (BCM) Policy. Version 1.0
NHS Central Manchester Clinical Commissioning Group (CCG) Business Continuity Management (BCM) Policy Version 1.0 Document Control Title: Status: Version: 1.0 Issue date: May 2014 Document owner: (Name,
More informationBusiness Continuity Management Governance. Frank Higgins Abu Dhabi March 2015
Business Continuity Management Governance Frank Higgins Abu Dhabi March 2015 Different Names Same Concept BCM (Business Continuity Management) BSI 25999 IPOCM (Incident Preparedness & Operational Continuity
More informationBusiness Continuity Policy
Business Continuity Policy St Mary Magdalene Academy V1.0 / September 2014 Document Control Document Details Document Title Document Type Business Continuity Policy Policy Version 2.0 Effective From 1st
More informationCourse: Information Security Management in e-governance. Day 1. Session 3: Models and Frameworks for Information Security Management
Course: Information Security Management in e-governance Day 1 Session 3: Models and Frameworks for Information Security Management Agenda Introduction to Enterprise Security framework Overview of security
More informationThe PNC Financial Services Group, Inc. Business Continuity Program
The PNC Financial Services Group, Inc. Business Continuity Program 1 Content Overview A. Introduction Page 3 B. Governance Model Page 4 C. Program Components Page 4 Business Impact Analysis (BIA) Page
More informationBusiness Continuity Planning in IT
Introduction: Business Continuity Planning in IT The more your business relies on its IT systems, the more you need to consider how unexpected disruptions might affect your business. These disruptions
More informationData Security Incident Response Plan. [Insert Organization Name]
Data Security Incident Response Plan Dated: [Month] & [Year] [Insert Organization Name] 1 Introduction Purpose This data security incident response plan provides the framework to respond to a security
More informationBusiness Continuity Management
Business Continuity Management Policy Statement & Strategy July 2009 Basildon District Council Business Continuity Management Policy Statement The Council is committed to ensuring robust and effective
More informationBUSINESS CONTINUITY POLICY
BUSINESS CONTINUITY POLICY Document Type Corporate Policy Unique Identifier CO-038 Document Purpose To provide a structure through which: i. A comprehensive business continuity management system (BCMS)
More informationCoping with a major business disruption. Some practical advice
Coping with a major business disruption Some practical advice Coping with a major business disruption What is business continuity? Business continuity planning (BCP) is a management process that helps
More informationBUSINESS CONTINUITY MANAGEMENT GUIDELINES FOR BANKS AND FINANCIAL INSTITUTIONS
BUSINESS CONTINUITY MANAGEMENT GUIDELINES FOR BANKS AND FINANCIAL INSTITUTIONS DIRECTORATE OF BANKING SUPERVISION AUGUST 2009 TABLE OF CONTENTS PAGE 1.0 INTRODUCTION..3 1.1 Background...3 1.2 Citation...3
More informationNeed to protect your business from potential disruption? Prepare for the unexpected with ISO 22301.
Need to protect your business from potential disruption? Prepare for the unexpected with. Why BSI? Keep your business running with and BSI. Our knowledge can transform your organization. For more than
More informationBusiness Continuity (Policy & Procedure)
Business Continuity (Policy & Procedure) Publication Scheme Y/N Can be published on Force Website Department of Origin Force Operations Policy Holder Ch Supt Head of Force Ops Author Business Continuity
More informationBUSINESS CONTINUITY MANAGEMENT FRAMEWORK
BUSINESS CONTINUITY MANAGEMENT FRAMEWORK Document Author: Civil Contingencies Service - Authorised by the CCS Joint Management Board - Version 1.0. Issued December 2012 Page 1 FRAMEWORK STATEMENT Business
More informationCRISC Glossary. Scope Note: Risk: Can also refer to the verification of the correctness of a piece of data
CRISC Glossary Term Access control Access rights Application controls Asset Authentication The processes, rules and deployment mechanisms that control access to information systems, resources and physical
More informationThe PNC Financial Services Group, Inc. Business Continuity Program
The PNC Financial Services Group, Inc. Business Continuity Program subsidiaries) 1 Content Overview A. Introduction Page 3 B. Governance Model Page 4 C. Program Components Page 4 Business Impact Analysis
More informationISO IEC 27002 2005 (17799 2005) TRANSLATED INTO PLAIN ENGLISH
13.1 REPORT INFORMATION SECURITY EVENTS AND WEAKNESSES 1 GOAL Make sure that information system security incidents are promptly reported. 2 GOAL Make sure that information system security events and weaknesses
More informationSection A: Introduction, Definitions and Principles of Infrastructure Resilience
Section A: Introduction, Definitions and Principles of Infrastructure Resilience A1. This section introduces infrastructure resilience, sets out the background and provides definitions. Introduction Purpose
More informationBusiness Continuity and Disaster Recovery Planning from an Information Technology Perspective
Business Continuity and Disaster Recovery Planning from an Information Technology Perspective Presenter: David Bird, Director of Sales, Business Technology Consultant phone: 215-672-7100 email: dbird@quatro.com
More informationState of South Carolina Policy Guidance and Training
State of South Carolina Policy Guidance and Training Policy Workshop All Agencies Business Continuity Management Policy June 2014 Agenda Questions & Follow-Up Policy Workshop Overview & Timeline Policy
More informationUpdate from the Business Continuity Working Group
23 June 2014 Performance and Resources Board 19 To note Update from the Business Continuity Working Group Issue 1 The Business Continuity Working Group oversees the development, maintenance and improvement
More informationBusiness Continuity Planning (BCP) / Disaster Recovery (DR)
Business Continuity Planning (BCP) / Disaster Recovery (DR) Introduction Interruptions to business functions can result from major natural disasters such as earthquakes, floods, and fires, or from man-made
More informationDisaster Recovery Remote off-site Storage for single server environment
. White Paper Disaster Recovery Remote off-site Storage for single server environment When it comes to protecting your data there is no second chance January 1, 200 Prepared by: Bill Schmidley CompassPoint
More informationINFORMATION SECURITY GOVERNANCE ASSESSMENT TOOL FOR HIGHER EDUCATION
INFORMATION SECURITY GOVERNANCE ASSESSMENT TOOL FOR HIGHER EDUCATION Information security is a critical issue for institutions of higher education (IHE). IHE face issues of risk, liability, business continuity,
More informationSummary of CIP Version 5 Standards
Summary of CIP Version 5 Standards In Version 5 of the Critical Infrastructure Protection ( CIP ) Reliability Standards ( CIP Version 5 Standards ), the existing versions of CIP-002 through CIP-009 have
More informationPrinciples for BCM requirements for the Dutch financial sector and its providers.
Principles for BCM requirements for the Dutch financial sector and its providers. Platform Business Continuity Vitale Infrastructuur Financiële sector (BC VIF) Werkgroep BCM requirements 21 September 2011
More informationBUSINESS CONTINUITY POLICY
BUSINESS CONTINUITY POLICY Last Review Date Approving Body n/a Audit Committee Date of Approval 9 th January 2014 Date of Implementation 1 st February 2014 Next Review Date February 2017 Review Responsibility
More information9/3/2009. Information Systems Disaster Recovery. Learning Objectives. Why have a plan? unexpected? APPA-Institute for Facilities Management
Information Systems Disaster Recovery APPA-Institute for Facilities Management J. Craig Klimczak, D.V.M., M.S. Vice-Chancellor for Technology St. Louis Community College 300 South Broadway St. Louis, MO
More informationState Agency Cyber Security Survey v 3.4 2 October 2014. State Agency Cybersecurity Survey v 3.4
State Agency Cybersecurity Survey v 3.4 The purpose of this survey is to identify your agencies current capabilities with respect to information systems/cyber security and any challenges and/or successes
More informationDoes it state the management commitment and set out the organizational approach to managing information security?
Risk Assessment Check List Information Security Policy 1. Information security policy document Does an Information security policy exist, which is approved by the management, published and communicated
More informationNEEDS BASED PLANNING FOR IT DISASTER RECOVERY
The Define/Align/Approve Reference Series NEEDS BASED PLANNING FOR IT DISASTER RECOVERY Disaster recovery planning is essential it s also expensive. That s why every step taken and dollar spent must be
More informationBusiness Continuity Management Systems. Protecting for tomorrow by building resilience today
Business Continuity Management Systems Protecting for tomorrow by building resilience today Vital statistics 31% 40% of UK businesses have been affected by bad weather related transport problems, power
More informationIT Service Management
IT Service Management Service Continuity Methods (Disaster Recovery Planning) White Paper Prepared by: Rick Leopoldi May 25, 2002 Copyright 2001. All rights reserved. Duplication of this document or extraction
More informationPBSi Business Continuity Planning
Business Continuity Planning Definition Business Continuity planning is a planning process designed to reduce the risk that disruptive failures or events could seriously harm your business. It is designed
More informationBusiness Continuity Planning for Risk Reduction
Business Continuity Planning for Risk Reduction Ion PLUMB ionplumb@yahoo.com Andreea ZAMFIR zamfir_andreea_ileana@yahoo.com Delia TUDOR tudordelia@yahoo.com Faculty of Management Academy of Economic Studies
More informationBest Practices in Disaster Recovery Planning and Testing
Best Practices in Disaster Recovery Planning and Testing axcient.com 2015. Axcient, Inc. All Rights Reserved. 1 Best Practices in Disaster Recovery Planning and Testing Disaster Recovery plans are widely
More informationINFORMATION SECURITY PROCEDURES
INFORMATION AN INFORMATION SECURITY PROCEURES Parent Policy Title Information Security Policy Associated ocuments Use of Computer Facilities Statute 2009 Risk Management Policy Risk Management Procedures
More informationFINAL May 2005. Guideline on Security Systems for Safeguarding Customer Information
FINAL May 2005 Guideline on Security Systems for Safeguarding Customer Information Table of Contents 1 Introduction 1 1.1 Purpose of Guideline 1 2 Definitions 2 3 Internal Controls and Procedures 2 3.1
More informationDisaster Recovery. 1.1 Introduction. 1.2 Reasons for Disaster Recovery. EKAM Solutions Ltd Disaster Recovery
Disaster Recovery 1.1 Introduction Every day, there is the chance that some sort of business interruption, crisis, disaster, or emergency will occur. Anything that prevents access to key processes and
More informationNHS Hardwick Clinical Commissioning Group. Business Continuity Policy
NHS Hardwick Clinical Commissioning Group Business Continuity Policy Version Date: 26 January 2016 Version Number: 2.0 Status: Approved Next Revision Due: January 2017 Gordon Stevens MBCI Corporate Assurance
More informationBusiness Continuity Management For Small to Medium-Sized Businesses
Business Continuity Management For Small to Medium-Sized Businesses Produced by NORMIT and Norfolk County Council Resilience Team For an electronic copy of this document visit www.normit.org Telephone
More informationBusiness Continuity Management
Business Continuity Management Version 1 approved by SMG December 2013 Business Continuity Policy Version 1 1 of 9 Business Continuity Management Summary description: This document provides the rationale
More informationInformation Technology Engineers Examination. Information Technology Service Manager Examination. (Level 4) Syllabus
Information Technology Engineers Examination Information Technology Service Manager Examination (Level 4) Syllabus Details of Knowledge and Skills Required for the Information Technology Engineers Examination
More informationAssessment of natural hazards, man made hazards, technical and societal related risks and associated impact.
Aon Business Continuity Planning The Aon Business Continuity Planning practice provides consulting services that allow Aon clients to measure and manage their strategic and tactical risks through Crisis
More information