disaster biz resumpt
TRANSCRIPT
Prepared: 04/13/23 1
Corp. AWS Overview
Security & Business Continuity
04/13/23 2
Introduction
To preserve of the business in the face of major disruptions to normal business operations.
Describe objectives of the domain– Theoretical– Practical– Significance
04/13/23 3
Domain Topics
BCP vs. DRP BIAs Contingency Planning End User Environment Backup Alternatives Recovery and Restoration Choosing a Software Backup Facility Testing and Drills Emergency Response
04/13/23 4
Information Security Requirements BCP and DRP are part of the Security Policy and
Program. Policy statement set by executive staff. Not optional. Must include the business. This is true at Corp.
04/13/23 5
BCP vs. DRP Business Continuity Planning is addresses the needs to
maintain the business until the situation returns to normal (pre-disaster situation).
Disaster Recovery Planning is aimed at minimizing the effects of a impact and ensuring that resources, personnel, and business processes are able to resume in a timely manner.
BCP’s goal is to keep the business running… DRP’s goal is to resume a lost part of the business. Just because you lose a system, you may not implement
BCP.– E.g.. Server crash, 4 hour SLA, 2 hour rebuild– E.g.. System crash, 3 hour failover & expense, 5 hour recovery
04/13/23 6
EmergencyEmergencyManagement TeamManagement Team
Crisis Management TeamCrisis Management Team
Business ResumptionBusiness Resumption
Business Resumption Business Resumption Resource Support TeamResource Support Team
Cohesive Response
Vital Records
FacilitiesServices
InformationTechnology
Communications
PurchasingMaintenance
Space Planning
Security
04/13/23 7
Business Impact Analysis
A BIA is performed before a plan is written to identify the areas that are at greatest financial or operation loss in the event of a disaster or disruption.
How?• develop materials
• gather information (quantitative & qualitative)
• analyze and interpret
• prepare and recommend
Corp. Practice: Corp. completed an initial BIA in December of 2001. It is red cover and wascompiled from 200+ key business personnel. Managed at IT Staff and Audit Level.
04/13/23 8
BIA cont.
Major deliverable– Identify vulnerabilities
04/13/23 9
Establishment of Priorities
Organizing when to do what Resource limitations
– facilities– people– hardware– backup
Corp. Practice: We have tiered priorities and people response. We are taking that down to aview per site and datacenter.
04/13/23 10
Critical Business Functions
What is most important to a company. Identified by senior management. Supports or defines the mission of the
company. Almost always the money chain. Measured in cost per hour of downtime.
04/13/23 11
Create RequisitionIssue P.O.Manage Purchase OrderManage Receiving VariancesManage ContractsRequest Supplier Quote (RFQ)Certify SuppliersMaintain Supplier Master DataManage Supplier PerformanceDisposition Unneeded MaterialManage Replenishment ProgramsReview Stock StatusCreate Labor Resource PlanCreate Local/Factory Capacity PlanEvaluate Global CapacityCreate Detailed Factory PlanCreate Production OrderRequest MaterialsDevelop Inventory StrategyManage Global Inventory Levels
ORDER
SHIP
CLOSEPAY
BUILDBus
ines
s
Proc
esse
s
Processes to Plans
Identify Business Processes Select Required Functions Identify Macro Processes Develop Plans
04/13/23 12
Emergency Response
Save lives, not a recovery exercise Reduce further injuries Secure the facilities Contain the situation
Corp. Practice:
04/13/23 13
Crisis Management
Coordinated disaster response. To mitigate further disruptions,
containment, secure facilities, coordinate and control external communications and activities.
Corp. Practice: CEOC - super event. EOC- Life and Limb IT-ERP is the team for IT.
04/13/23 14
Emergency Assessment
Understand the impact Determine the correct response
Corp. Practice: Done at the site level..
04/13/23 15
External Communications
Media Training Impact Perception vs. Reality
Corp. Practice: No one should talk to the press unless you have been approved and trainedto do so.
04/13/23 16
Containment Priorities
Life and Limb Assets Records
04/13/23 17
Training/Testing/Drilling
Checklist Test (Contact and part of SWT)
Structured Walkthrough (Structured Walkthrough)
Simulation (Functional)
Parallel (Functional)
Full-Interruption (Integrated)
Prepare people to react, respond, and resume operations under stressful and time critical situations. Mature our skill levels.
Corp. Practice: Contact done Quarterly, Structured Walkthroughs at least twice a year,Functional Test at least yearly, Integrated test performed once every two years.
04/13/23 18
Test Types – Contact Verification Validate Information for:
– Employees– Team members– Emergency Authorities– Vendor representatives– Customer representatives– Business partners– Media outlets / silos– Other stakeholders
Street Address
Cellular
Pager
Work
Home
Verify available contact
elements
04/13/23 19
Recovery Plan Development
BIA, SPOF's, Mitigation, Strategy, Priority, Scope, Approvals
Written for the recovery team. More generic.
Corp. Practice: BIA, SPOF Analysis, Strategy, Priority, Approval, Scope, Plan Creation (Process, Team, Positions, Tasks, Resources), Peer Review (SWC), Contact Test
04/13/23 20
Documentation
How to recover Essential steps Written for a specific audience Aims to document critical decisions before
the crisis
Corp. Practice: The system of record for IT is XXXXX The business uses MS-word. When they automate further, it will be in XXXx system.
04/13/23 21
Logistics and Supplies
Coordinated response for people to get the needed resources delivered to meet the recovery priorities and recovery objectives.
Why-– predefined streamlined processes provide real
time response instead of normal approval cycles which may have broken down when the disaster occurred
Corp. Practice: Driven by Priorities. Simplified to remove processes like procurement and approvals.
04/13/23 22
Data Recovery
RPO- Recovery Point Objective Recovery Priorities
Corp. Practice: IT staff has stated that we want no data loss. Hasn’t funded. RecoveryPriorities are being set per data center.
04/13/23 23
Backups and Offsite Storage
Types– Full –everything
– Incremental –modified files since last any backup
– Differential –everything since last full
Methods
Backup Facility –– accessible in your timeframes to recover
– available on demand
– fire “proof”
Corp. Practice: Strategy is undergoing major revisions. IT is your best source for program information.
04/13/23 25
Cold, Warm, Hot, Mobile Sites Subscription Services – for a fee. Cold Site – basic environment, electrical wiring,
air conditioning, plumbing, and flooring. (may take weeks to activate)
Warm Site – cold site basics plus some services (servers, backups, network)
Hot Site – everything for a quick failover. Usually less than 4 hours. Costly
Mobile Sites – e.g.. PBx in a flatbed, crash kits
Corp. Practice: We have a mixture. Moving away from subscriptions and toward companyowned internal hot sites.
04/13/23 26
A Successful Business Continuity Program
Testing
Up-to-DatePlan
TrainedPersonnel
Strategy
IBM S/370
Laptop computer
IBM PS/2
Business Continuity!!!
04/13/23 27
BCP/DRP Events
Links– DRJ (Disaster Recovery Journal)– DRI (Disaster Recovery Institute)– BCI (Business Continuity International)– Contingency Planning
04/13/23 28
Program Interdependency
Basic InfrastructureFacilities Power
Biz Apps/InfrastructureSAP WOM
Biz Functions Order Build Ship Close
Enabling Apps/Services Messaging Voicemail Conferencing Security
Basic Services Network Internet Intranet Telephony
IT Core BCP
Focus
Business BCP Focus
App/Service BCP Focus
External Requirements
04/13/23 29
Summary
Key Topics• BCP vs. DRP
• BIAs
• Contingency Planning
• End User Environment
• Backup Alternatives
• Recovery and Restoration
• Choosing a Software Backup Facility
• Testing and Drills
• Emergency Response
04/13/23 30
Questions
Why perform a risk analysis:– inventory assets– identify single points of failure– identify all data in all systems– review all procedures in all places
04/13/23 31
Questions
Primary function of the DR committee:– identify strategies– recover– identify weaknesses in systems– prepare for a disaster
04/13/23 32
Questions
Major purpose of a written plan:– satisfy auditors– satisfy regulatory authorities– minimize the pressure to make decisions– coordinate all parties
04/13/23 33
Questions
The ultimate goal of a disaster recovery plan is: – get operations up and running quickly– restore at least partial operations– get operations up and running efficiently– restore operations to a pre-disaster state
04/13/23 34
Questions
During a disaster, which procedures require coordinated efforts of a disaster recovery specialist and IS security specialists? – notifying employees– retrieving supplies– returning to the original site– recovering lost data
04/13/23 35
Questions
A proactive disaster recovery plan includes all but – UPS– emergency procedures– a provision for recovery after the disaster– a fire extinguisher
04/13/23 36
Questions
DRP and Security policies are:– separate but complementary– separate without substitution– can be one document– separate and diverse
04/13/23 37
Questions
Major purpose of a written plan:– minimize the pressure to make decisions
The ultimate goal of a disaster recovery plan is: – restore operations to a pre-disaster state
04/13/23 38
Questions
During a disaster, which procedures require coordinated efforts of a disaster recovery specialist and IS security specialists? – recovering lost data
Primary function of the DR committee:– recover
Why perform a risk analysis:– identify single points of failure
04/13/23 39
Questions
A proactive disaster recovery plan includes all but – a provision for recovery after the disaster
DRP and Security policies are:– separate but complementary