resiliency vs. disaster recovery there is a difference?...resiliency vs. disaster recovery ......

Richard Long, Senior Advisory ConsultantMHA Consulting / March 11, 2020

Resiliency vs. Disaster RecoveryIs There A Difference?

Company Background

A simple mission: Ensure

the continuous operations

of our clients’ critical

processes.

A 20-year proven track

record of applying industry

standards and best

practices across a diverse

pedigree of clients.

We seek to partner with

clients who have a

commitment to BCM versus

a check the box mentality.

SaaS Tools: BIA On-

Demand, BCM One,

Compliance Confidence,

Residual Risk.

20Years in

operation.

20Average years

industry experience.

CAPABLEComprehensive suite of services.

GLOBALDiverse, global

client base.

SAASCompliance and

risk tools.

K E Y F A C T S

Richard LongPractice Leader & Senior Advisory ConsultantPhoenix, Arizona www.mha-it.comwww.bcmmetrics.com

SENIOR LEADERSHIP

© 2020 MHA CONSULTING. ALL RIGHTS RESERVED. 2

http://www.mha-it.com/

http://www.bcmmetrics.com/

Unique or Competitive Advantage

Healthcare Financial InstitutionsServices Education

Consumer Products Insurance Travel & Entertainment Government/Utility


Robust Suite Of Services

EXERCISES CONTINUOUS IMPROVEMENT

ASSESS CURRENT ENVIRONMENT

CONTINUITY STRATEGIES &

SOLUTIONS

RESPONSE & RECOVERY PLANS

• Mock Disaster Exercises

• Plan Functional Walkthroughs

• Alternate Worksite Exercises

• Component, Full and Business Process Failovers

• Coordinated Third Party Exercises

• Business Continuity Strategies & Solutions

• IT Services Continuity Strategies & Solutions

• Supply Chain Continuity Strategies & Solutions

• Crisis Management

• Business Recovery

• IT Disaster Recovery

• Supply Chain Recovery

• Current State

• Policy & Standards

• Business Impact Analysis

• Threat & Risk Assessment

• On-going Training & Awareness Programs

• Post-Exercise Improvement Programs

• Refresh Current State Assessment

• Update BIAs & Threat Assessment

• Third Party Assessments

• Monitor & Measure Resilience Improvement


Why Are You Here?

Disaster Recovery and Resiliency:• Difference between the two• Components of each• Integration between them• When is one better than the other?


Risk

Resilience


The Big Picture

OTHER: Catastrophe 1.01%; Casualty Accidents 0.14%; Financial Damage 0.14%; Hostile Takeover 1.64%; Labor Issues 0.14%; Sexual Harassment 0.48%

ICM Annual Crisis Report, 2017. Institute for Crisis Management.


Cris is Spectrum

Life Safety

Incident Stabilization

Property Preservation

Restoration of the Business


Ris k Pr ior i t ies – Anot her Way To Look At R is k

S T A N D A R D S I N B U S I N E S S C O N T I N U I T Y

M E A S U R E C O M P L I A N C E I N T H E S E B C M D I M E N S I O N S

• ISO 22301

• FFIEC

• NIST 800

• NFPA 1600

• SEC

• FISMA

• FINRA

• Supply Chain Resiliency Leadership Council

• Program Administration

• Crisis Management

• Business Recovery

• IT Disaster Recovery

• Fire & Life Safety

• Supply Chain Risk Management

• Third Party Management


BC M C ompl ianc e St andar ds

• Identifies conditions or situations which may cause a business function outage.

• Identifies the probability of the risk occurring.• Identifies threats and hazards across all areas -

human, natural, technology, chemical/biological, etc.

• Identifies internal threats.• Assists in determining how to prevent

impact/outages.• Determines what risk will be mitigated and what

will not.

MDE


Ris k Management

DisasterRecovery

Disaster Recovery• Technical Recovery of processing capabilities• May include some high availability• Typically a delay between when outage event

occurs and when service is restored• Multiple technologies used in recovery

• Replication, backup restore, HA• Based on business requirements (RTO/RPO)• Unplanned• Often based on data center impact

Resiliency• Prevention of service outages• Includes day to day availability needs • Includes DR solutions• Includes technology and non-technology solutions• Functional focus• Planned and Unplanned• Based on risk appetite and tolerance• Component and non-data center impact

Resiliency


Bas ic C onc ept s

• APPETITE: Broad level of risk an organization will accept. • TOLERANCE: Specific level of risk for each measurement

or action.

Risk Appetite vs.

Risk Tolerance

APPETITE• High insurance deductible or no insurance• Have financial reserves• Low likelihood of occurrence

TOLERANCE• $5,000 medical deductible• No comprehensive coverage on older car –

will buy a car if needed

E X A M P L E S


Bas ic C onc ept s

• RISK ACCEPTANCE: Risk acceptance does not reduce any effects however it is still considered a strategy. This strategy is a common option when the cost of other risk management options such as avoidance or limitation may outweigh the cost of the risk itself. A company that doesn’t want to spend a lot of money on avoiding risks that do not have a high possibility of occurring will use the risk acceptance strategy.

• RISK AVOIDANCE: Risk avoidance is the opposite of risk acceptance. It is the action that avoids any exposure to the risk whatsoever. Risk avoidance is usually the most expensive of all risk mitigation options.

• RISK LIMITATION: Risk limitation is the most common risk management strategy used by businesses. This strategy limits a company’s exposure by taking some action. It is a strategy employing a bit of risk acceptance along with a bit of risk avoidance or an average of both. An example of risk limitation would be a company accepting that a disk drive may fail and avoiding a long period of failure by having backups.

• RISK TRANSFERENCE: Risk transference is the involvement of handing risk off to a willing third party. For example, numerous companies outsource certain operations such as customer service, payroll services, etc. This can be beneficial for a company if a transferred risk is not a core competency of that company. It can also be used so a company can focus more on their core competencies.

Risk Mitigation


Bas ic C onc ept s

• HUMAN ERROR: No process or checks will stop mistakes. The beauty and curse of humanity.

• INTENTIONAL: Knowingly taking shortcuts or not following known procedures.

• UNINTENTIONAL: Physical errors or mental or cognitive errors; where you do the wrong thing believing it to be right (i.e., making the wrong decision).

• DATA BREACH/RANSOMWARE: Occur every day.

• BRAND IMAGE/REPUTATIONAL DAMAGE: Examples are airlines, fast food, telecom.

• TECHNOLOGY OUTAGES: Examples are airline issues, cloud-based services, etc.

Current, Common Risks


Bas ic C onc ept s

Disaster Recovery01End User Technology supporting business functions

02

Infrastructure & Application Support03

Single Points of Failure04

People05

Pandemic06

Supply Chain07

Third Parties08

Components


Res i l ienc y

BIA Integration01Change Management02

Data Protection03

ComponentsRecovery Strategy04

Documentation05

Exercise and Testing06

07

Training and Awareness08

Maintenance (technology and plans)


Tec hnic al Res i l ienc yDis as t er Rec over y

• Alternate Site• Work space• Data Center• Remote access (VDI, VPN)

• Sufficient Capacity• Redundant hardware• Backup and Restore• Replication (storage and server)• High Availability• Cloud Services• High Availability vs Recoverability

Common Tool Set


Tec hnic al Res i l ienc y

Availability solutions for environments and processes can be separate from “DR”ORcan be the “DR” Solution as they typically meet or exceed the RTO/RPO requirements


Tec hnic al Res i l ienc y (Avai labi l i t y and Rec over y)

• LAN/WAN – redundant components in at least two locations

• Telephony – typically required to be highly available either at alternate location or redundant service

• Authentication – redundancy and failover in at least two locations

• Security Monitoring – redundant components or outside service provider

• Remote Access – redundant components• Capacity and licenses• End user devices• Mobile Device Management (MDM)

Tier 0 ServicesH i g h l y A v a i l a b l e a n d n o t d e p e n d e n t o n a s i n g l e l o c a t i o n


Res i l ienc y C ons ider at ions

• Intra data center vs Inter data center• Network bandwidth concerns• Latency sensitivity• Integration complexity

• Hardware Resiliency• Within the hardware• Redundant hardware

• OS Resiliency• Monitoring and notifications• Automated process restart

• Application layer redundancy• Self-healing processes• Clustered servers

InfrastructureB u s i n e s s r e q u i r e m e n t b a s e d


Res i l ienc y and DR Int egr at ion

• Remote Access• Capacity and Licensing• End user training• Access restrictions

• Device (personal vs. org provided)• Location/tech specs

• Device Resiliency• How to ensure all staff have appropriate devices when needed

• VDI from any device• Device as a Service (longer lead time)• Depot of equipment

• Inventory devices and persons assigned• MDM

• OS Resiliency• Monitoring and notifications• Automated process restart

• Application layer redundancy• Self-healing processes• Clustered servers

Business and End User TechnologiesB u s i n e s s r e q u i r e m e n t b a s e d



• Single Points of Failure• Identify those with specific knowledge or skill set• Documentation• Cross Training

• Training in their role for Resiliency• Recovery• Prevention• Testing• Access

• Access to tools for secondary responsibility

• IT Resource Constraints• Pandemic• Current vendors ability to provide services/staff augmentation

PeopleJ u s t a s i m p o r t a n t a s t e c h n o l o g y



• Formal prioritization of third parties• Documentation of service, contact, escalation• Assessment of their resiliency position

• Single source vendors• Work arounds for service or product• Alternate vendors selection or integration plan

• Inventory of Additional Services of current vendors

• Identification of alternate vendors of who can support SPOFs• Plan for use or agreements

Third PartiesD o y o u u n d e r s t a n d y o u r d e p e n d e n c e a n d t h e i r r e s i l i e n c e ?



Resiliency

DisasterRecovery


T here is no d i fferenc e bet w een DR and Res i l ienc y

W h a t F i r s t ?

• Categorize risks and needs

• Determine current SPOFs and Gaps

• Prioritize SPOFs and Gaps

• Tier 0 for Resiliency

• Functional DR capability


W her e To Foc us

Richard [email protected](602) 370-1864

Thank You!

Questions?

resiliency vs. disaster recovery there is a difference?...resiliency vs. disaster recovery ......

Documents