Date: 08 januari 2014

Name: John van Leeuwen

Presentation for BCI meeting – Not to be disclosed outside this meeting 0

KPN

Service Resilience Overview

NetCo Business Continuity & Security

Topics

1. Business Continuity and Security environment and stakeholders of KPN

2. KPN standard to vital Services and Buildings

3. Methods used

4. Approach

5. BCM cockpit method

6. BCM GAP analysis

7. Risk analysis

8. Dashboard overview results

9. Questions

1

KPN - for internal use

1. Business Continuity and Security environment and stakeholders of KPN

Natural disasters

• Flooding

• Storms

• Extreme heat, Fires

Attacks, incidents

• Cyber crime

• Terrorism

• Nuclear, chemical

incident

Community

• Our society trusts on the

availability of KPN’s

networks and services and

on the Integrity and

trustworthiness of its

Telecommunication

facilities during incidents

and/or disasters.

• The Dutch business relies

on the availability of KPN’s

services to do business.

Government

• KPN = Vital Infrastructure

• Stricter Legislation

e.g. reporting obligation for

continuity or privacy

incidents.

• Stricter verification /

assurance by “Agentschap

Telecom”

KPN

• KPN’s fulfilment of it’s

promise ‘the best

Network’

• Impact of incident/

disaster on KPN

Image

Churn

Revenue Loss

Fines

Customers

• Customer requirements

concerning the protection

of Information and the

continuation of services

increase year by year.

• Customers expect KPN to

be organised, planned

and in control during

incidents and disasters

Competitors

• Retain “best network”

advantage

• Keep up being on par with

competitors

• Security & BCM as a

“Business Enabler”

• BCS = Unique selling

point when good

implemented.

People

• Pandemic, Strike

• Terrorism

• Sabotage

• Espionage

Outsourcing / offshoring

• The right implementation of

Security en BCM rules,

measures and KPI’s in

contracts and Service

Levels with offshore and

outsourcing partners 2

Human Failure

• Cable cut disruptions

• Errors in implementations

• Violation of architectural rules

and guidelines

• Non compliance to BCM policy

KPN - for internal use

2. KPN standard to vital Services and Buildings

3

BCM decision in NL Board

The KPN NL Board took decisions with respect to the continuity of our services:

• Set of critical services

• Set of critical buildings

• BCM standards for critical services and buildings

BCM standard - target

• Internal – (not for externl distribution in tis presentation)

BCM Cockpit

• Robustness of a

service in 14 different

areas and compared to

the benchmark

• Check on availability

and completeness of

continuity plans in

LDRPS

• Outcome provides

insight into current

status and risks of

continuity

GAP Analysis

• Architecture of a

service developed

before 2010 checked

upon the BCM

guidelines

• Outcome provides

insight into necessary

measures to prevent

serious service

interruptions

• Necessary measures

included on the

roadmap

4

Risk Analysis

• Security and continuity

risks of a service

identified, based on

best practice (ISF),

from business process

to network architecture

• Outcome is Risk

Treatment Plan,

including measures for

risk mitigation,

ownership and

necessary resources

3. Methods used

Different analyses with their own goals

Business Impact

Analysis • Determine criticality of

Confidentiality,

Integrity or Availability

of a service from a

business perspective

• Prioritize services

based upon results BIA

• Outcome provides

insight on impact on

image and sales of

service interruption by

extensive failures (and

/ or emergencies)

Business Impact Assessment

4 uur

Naam (voornaam + achternaam)Datum

(dd-mm-jjjj)nee

Nee

Ja

Ja

Overall Score business impact Very high High Medium Low Very low Classificatie

X Verlies van vertrouwelijkheid High

X Verlies van integriteit High

> 1 week > 1 week > 1 dag > 4 uur > 4 uur Onbeschikbaarheid Medium

Overall score process impact Very high High Medium Low Very low MAD

Vertrouwel i jkheid XIntegri tei t X

Vertrouwel i jkheid XIntegri tei t X

Vertrouwel i jkheid X

Integri tei t X

Vertrouwel i jkheid X

Integri tei t XVertrouwel i jkheid X

Integri tei t X

Voor dienst geldt meldpl icht vanuit

Agentschap Telecom

Dienst verwerkt persoongegevens

Dienst i s gecerti ficeerd voor securi ty of

continuitei t

Dienst s taat op l i js t KPN kri tieke diensten

Maximale dienst ui tva l (MTPD)

Billing & Collections

Sales & ordering

Akkoord

Continue

dienstverlening

Initiele levering

Assurance

0 minuten4 uur

48 uur

0 minuten

MTPD

Verlies van vertrouwelijkheid

Verlies van integriteit

Onbeschikbaarheid

48 uur

ONWAAR

48 uur

0 minuten

0 minuten

0 minuten

Business Impact Assessment

4 uur

Naam (voornaam + achternaam)Datum

(dd-mm-jjjj)nee

Nee

Ja

Ja

Overall Score business impact Very high High Medium Low Very low Classificatie

X Verlies van vertrouwelijkheid High

X Verlies van integriteit High

> 1 week > 1 week > 1 dag > 4 uur > 4 uur Onbeschikbaarheid Medium

Overall score process impact Very high High Medium Low Very low MAD

Vertrouwel i jkheid XIntegri tei t X

Vertrouwel i jkheid XIntegri tei t X

Vertrouwel i jkheid X

Integri tei t X

Vertrouwel i jkheid X

Integri tei t XVertrouwel i jkheid X

Integri tei t X

Voor dienst geldt meldpl icht vanuit

Agentschap Telecom

Dienst verwerkt persoongegevens

Dienst i s gecerti ficeerd voor securi ty of

continuitei t

Dienst s taat op l i js t KPN kri tieke diensten

Maximale dienst ui tva l (MTPD)

Billing & Collections

Sales & ordering

Akkoord

Continue

dienstverlening

Initiele levering

Assurance

0 minuten4 uur

48 uur

0 minuten

MTPD

Verlies van vertrouwelijkheid

Verlies van integriteit

Onbeschikbaarheid

48 uur

ONWAAR

48 uur

0 minuten

0 minuten

0 minuten

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

1Operation

sProcesses 2

IncidentPreventio

n and… 3 Partner/ SupplierManagem

ent

4 HumanResource

s

5Document

ation

6Capacity

Management

7Security

8Network

Architecture

9Redundan

cy

10 SiteInfrastruct

ure

11BusinessContinuityManage…

12Emergenc

y Plans

13Support

Processes

14AdditionalInformation Request

BCM Cockpit

Current Level Average 2013Worst Case 2013Current Level Average 2012Worst Case 2012Reference

5

0%

20%

40%

60%

80%

100%

1Operati

ons… 2

IncidentPrev…

3Partner

/…

4HumanReso…

5Documentati…

6Capacit

y… 7

Security

8Networ

k…

9Redund

ancy

10Site

Infras…

11Busine

ss…

12Emerge

ncy…

13Support

Proc…

14Additio

nal…

BCM Cockpit

Current Level Average 2013Worst Case 2013Current Level Average 2012Worst Case 2012Reference

Business Impact Analyse

Risk Treatment Plan

Threat & Vulnerability Assessment

BCM Cockpit BCM GAP Analyse

+ +

A

A

4. Approach All analysis lead to one integrated overview with highest risks and

recommendations

Risk Analysis

Classificatie

Confidentiality Medium

Integrity Medium

Availability Medium

+ +

Classification: Internal

Continuity Plans

C&I C&I

5a. The BCM cockpit method (1)

● There is 1 cockpit for each service

● The service will be split up in different

elements

● Most important process is continuous

delivery, expandable with extra processes

and components like billing and IT.

● 180 questions per component divided in

14 chapters.

− Top questions are rated with 10 points

− Normal questions are rated with 1 point

− Informative questions are rated with no

points

− N/A doesn't count

− Don’t know: in this case the question

must be answered by someone with

specific in-depth knowledge 6

5b. Overview BCM cockpit

180 questions on 14 subjects

Operational processes Operations Processes

Incident Prevention and Analysis

Partner / Supplier Management

Human Resources

Documentation

Tactical processes Capacity Management

Security

Network Architecture

Redundancy

Site Infrastructure

Business Continuity processes

Business Continuity Management

Emergency Plans

Support Processes

Additional Information Request

7

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

1 OperationsProcesses

2 IncidentPrevention

and Analysis

3 Partner /Supplier

Management

4 HumanResources

5Documentati

on

6 CapacityManagement

7 Security

8 NetworkArchitecture

9Redundancy

10 Site /Location

Infrastructure

11 BusinessContinuity

Management

12Emergency

Plans

13 SupportProcesses

14 AdditionalInformation

Request

Service Overview

Reference Questionnaire Score Average

Questionnaire Score Worst Case Current Level Average

Current Level Worst Case

6. BCM GAP analysis

8

This GAP analysis examines the

architecture of a critical service. The

following elements will be examined:

• Loss of building

• Loss of data room

• Loss of rack/component

Purpose of this analysis:

• Determine a complete list of

improvements needed to comply

with the KPN BCM guidelines.

• Describe the impact of

ongoing/planned projects on the

found points of improvement.

• Determine other desired

improvement proposals.

7. The Risk Analysis

9

Threat and Vulnerability Assessment helps to determine unacceptable risks

10

8a. Dashboard overview results

Diagram Legend (How to read the Dashboard)

BCM Pie chart:

C I A A BIA: C: Confidentiality

I: Integrity

A: Availability

BCM Cockpit: >= 86% [43% - 69%] [70% - 85%] <= 42%

Plans:

Architecture

guidelines:

= 100% ready in LDRPS + exercised

= 100% ready in LDRPS + not exercised

<100% ready in LDRPS + not exercised

LEGEND

= ok

= not ok

= not available

low medium high not available

= not available

Service layer Network layer Physical layer

Risks • Risk 1

• Risk 2 • Risk 3

Recommendations • (temporarily) accept or

mitigate risks.

• New projects to improve

resilience

• Running projects to close GAP

11

Continuity Plans Continuity Plans

BCM Cockpit BCM Cockpit

BIA BIA

Architecture

guidelines

Architecture

guidelines

NetCo semi-finished

product ->

8b. Example - Service x Resilience overview

Risks and recommendations

*) Architecture guidelines are not

applicable at this level

* *

12

Current situation: Medio 2015:

8c. Example Overall resilience overview service X Resilience after completion of existing and recommended projects

C I A C I A

9. Questions

13

KPN NetCo Business Continuity & Security