Business Continuity Planning

LTU CISP Security 1

Business Continuity Planning

The Problem - Reasons for Business Continuity Planning - BCP

Principles of BCP Doing BCP

The stepsWhat is includedThe stages of an incident

LTU CISP Security 2

Definitions

A contingency plan is:“A plan for emergency response, backup operations,

and post-disaster recovery maintained by an activity as a part of its security program that will ensure the availability of critical resources and facilitate the continuity of operations in an emergency situation…”

(National Computer Security Center 1988)

1997-98 survey >35% of companies have no plans

LTU CISP Security 3

Definitions of BCP

Disaster Recovery Business Continuity Planning End-user Recovery Planning Contingency Planning Emergency Response Crisis Management

The goal is to assist the organization/business to continue functioning even though normal operations are disrupted

Includes steps to take Before a disruption During a disruption After a disruption

LTU CISP Security 4

Reasons for BCP

It is better to plan activities ahead of time rather than to react when the time comes“Proactive” rather than “Reactive”Take the correct actions when neededAllow for experienced personnel to be absent

LTU CISP Security 5

Reasons for BCP

It is better to plan activities ahead of time rather than to react when the time comes“Proactive” rather than “Reactive”

Maintain business operations Keep the money coming in Short and long term loss of business Have necessary materials, equipment, information on hand Saves time, mistakes, stress and $$ Planning can take up to 3 years

LTU CISP Security 6

Reasons for BCP

It is better to plan activities ahead of time rather than to react when the time comes“Proactive” rather than “Reactive”

Maintain business operations Keep the money coming in Short and long term loss of business

Effect on customersPublic imageLoss of life

LTU CISP Security 7

Reasons for BCP

It is better to plan activities ahead of time rather than to react when the time comes“Proactive” rather than “Reactive”

Maintain business operations Keep the money coming in Short and long term loss of business

Effect on customers Legal requirements

‘77 Foreign Corrupt Practices Act/protection of stockholders Management criminally liable

LTU CISP Security 8

Reasons for BCP

It is better to plan activities ahead of time rather than to react when the time comes

“Proactive” rather than “Reactive”

Maintain business operations Keep the money coming in Short and long term loss of business

Effect on customers Legal requirements

‘77 Foreign Corrupt Practices Act/protection of stockholders Federal Financial Institutions Examination Council (FFIEC) FCPA SAS30 Audit Standards Defense Investigative Service Legal and Regulatory sanctions, civil suits

LTU CISP Security 9

Definitions

Due Careminimum and customary practice of

responsible protection of assets that reflects a community or societal norm

Due Diligenceprudent management and execution of due

care

LTU CISP Security 10

The Problem

Utility failures Intruders Fire/Smoke Water Natural disasters (earthquakes, snow/hail/ice, lightning,

hurricanes) Heat/Humidity Electromagnetic emanations Hostile activity Technology failure

LTU CISP Security 11

Recent Disasters

Bombings ‘92 London financial district ‘93 World Trade Center, NY ‘93 London financial district ‘95 Oklahoma City ’01 World Trade Center, NY (9/11)

Earthquakes ‘89 San Francisco ‘94 Los Angeles ‘95 Kobe, JP

Fires ‘95 Malden Mills, Lawrence, MA ‘96 Credit Lyonnais, FR ‘97 Iron Mountain Record Center, Brunswick, NJ

LTU CISP Security 12

Recent Disasters

Power ‘92 AT&T ‘96 Orrville, OH ‘99 East coast heat/drought brownouts

Floods ‘97 Midwest floods

Storms ‘92 Hurricane Andrew ‘93 Northeast Blizzard ‘96 Hurricanes Bertha, Fran ‘98 Florida tornados

Hardware/Software Year 2000

LTU CISP Security 13

The Problem

Utility failures Intruders Fire/Smoke Water Natural disasters (earthquakes, snow/hail/ice, lightning, hurricanes) Heat/Humidity Electromagnetic emanations Hostile activity Technology failure

Failure to keep operatingFortune 1000 study Average loss $78K, up to $500K 65% failing over 1 week never reopen Loss of market share common

LTU CISP Security 14

Threats

From Data Pro reportsErrors & omissions 50%Fire, water, electrical 25%Dishonest employees 10%Disgruntled employees 10%Outsider threats 5%

LTU CISP Security 15

The Controls

Least Privilege Information security

Redundancy Backed up dataAlternate equipmentAlternate communicationsAlternate facilitiesAlternate personnelAlternate procedures

LTU CISP Security 16

The Steps in a BCP - Initiation

Project initiation Business case to obtain support Sell the need for DRP (price vs benefit) Build and maintain awareness On-going testing & maintenance Top down approach Executive commitment and support MOST CRITICAL Project planning, staffing

Local support/responsibility

LTU CISP Security 17

The Steps in a BCP - 1

Impact Assessment (Impact Analysis/Vulnerability Assessment/Current State Assessment/Risk Assessment )Purpose Identify risks Identify business requirements for continuity Quantify impact of potential threats Balance impact and countermeasure cost Establish recovery priorities

LTU CISP Security 18

Benefits

Relates security objectives to organization mission Quantifies how much to spend on security measures Provides long term planning guidance

Building design HW configuration SW Internal controls Criteria for contingency plans Security policy Site selection

Protection requirements Significant threats Responsibilities

LTU CISP Security 19

The Steps in a BCP - 1

Risk AssessmentPotential failure scenariosLikelihood of failureCost of failure (loss impact analysis)

Dollar losses Additional operational expenses Violation of contracts, regulatory requirements Loss of competitive advantage, public confidence

Assumed maximum downtime (recovery time frames) Rate of losses Periodic criticality Time-loss curve charts

LTU CISP Security 20

The Steps in a BCP - 1

Risk Assessment/Analysis Potential failure scenarios (risks) Likelihood of failure Cost of failure, quantify impact of threat Assumed maximum downtime Annual Loss Expectancy Worst case assumptions Based on business process model? Or IT model? Identify critical functions and supporting resources Balance impact and countermeasure cost

Key - Potential damage Likelihood

LTU CISP Security 21

Definitions

Threat any event which could have an undesirable impact

Vulnerability absence or weakness of a risk-reducing safeguard, potential to allow

a threat to occur with greater frequency, greater impact, or both Exposure a measure of the magnitude of loss or impact on the value of the

asset

Risk the potential for harm or loss, including the degree of confidence of

the estimate

LTU CISP Security 22

Definitions

Quantitative Risk Analysis quantified estimates of impact, threat frequency, safeguard

effectiveness and cost, and probability Powerful aid to decision making Difficult to do in time and cost

Qualitative Risk Analysis minimally quantified estimates Exposure scale ranking estimates Easier in time and money Less compelling

Risk Analysis is performed as a continuum from fully qualitative to less than fully quantitative

LTU CISP Security 23

Results

Loss impact analysis Recovery time frames

Essential business functions Information systems applications

Recommended recovery priorities & strategies Goals

Understand economic & operational impact Determine recovery time frame (business/DP/Network) Identify most appropriate strategy Cost/justify recovery planning Include BCP in normal decision making process

LTU CISP Security 24

Risk Management Team

Management - Support DP Operations Systems Programming Internal Audit Physical Security Application owners Application programmers

LTU CISP Security 25

Preliminary Security Exam

Asset costs Threat survey

Personnel Physical environment HW/SW Communications Applications Operations Natural disasters Environment Facility Access Data value

LTU CISP Security 26

Preliminary Security Exam

Asset costs Threat survey Existing security measures Management review

LTU CISP Security 27

Threats

Hardware failure Utility failure Natural disasters Loss of key personnel Human errors Neighborhood hazards Tampering Disgruntled employees Emanations Unauthorized access Safety Improper use of technology Repetition of errors Cascading of errors

• Illogical processing• Translation of user needs

(technical requirements)• Inability to control

technology• Equipment failure• Incorrect entry of data• Concentration of data• Inability to react quickly• Inability to substantiate

processing• Concentration of

responsibilities• Erroneous/falsified data• Misuse

LTU CISP Security 28

Threats

Uncontrolled system access Ineffective application security Operations procedural errors Program errors Operating system flaws Communications system failure Utility failure

LTU CISP Security 29

Risk Analysis Steps

1 - Identify essential business functions Dollar losses or added expense Contract/legal/regulatory requirements Competitive advantage/market share Interviews, questionnaires, workshops

2 - Establish recovery plan parameters Prioritize business functions

3 - Gather impact data/Threat analysis Probability of occurrence, source of help Document business functions Define support requirements Document effects of disruption Determine maximum acceptable outage period Create outage scenarios

LTU CISP Security 30

Risk Analysis Steps

4 - Analyze and summarize Estimate potential losses

Destruction/theft of assets Loss of data Theft of information Indirect theft of assets Delayed processing Consider periodicity

Combine potential loss & probability Magnitude of risk is the ALE (Annual Loss

Expectancy) Guide to security measures and how much to spend

LTU CISP Security 31

Results

Significant threats & probabilities Critical tasks & loss potential by

threat Remedial measures

Greatest net reduction in losses Annual cost

LTU CISP Security 32

Information Valuation

Information has cost/value Acquire/develop/maintain Owner/Custodian/User/Adversary

Do a cost/value estimate for Cost/benefit analysis Integrate security in systems Avoid penalties Preserve proprietary information Business continuity

Circumstances effect valuation timing Ethical obligation to use justifiable tools/techniques

LTU CISP Security 33

Conditions of Value

Exclusive possession Utility Cost of creation/recreation Liability Convertibility/negotiability Operational impact Market forces Official value Expert opinion/appraisal Bilateral agreement/contract

LTU CISP Security 34

Scenario

A specific threat (potential event/act) in which assets are subject to loss

Write scenario for each major threat Credibility/functionality review Evaluate current safeguards Finalize/Play out Prepare findings

LTU CISP Security 35

The Steps in a BCP - 2

Strategy Development (Alternative Selection)Management supportTeam structureStrategy selection

Cost effective Workable

LTU CISP Security 36

The Steps in a BCP - 3

Implementation (Plan Development)Specify resources needed for recoveryMake necessary advance arrangementsMitigate exposures

LTU CISP Security 37

The Steps in a BCP - 3

Risk Prevention/Mitigation Security - physical and information (access) Environmental controls Redundancy - Backups/Recoverability

Journaling, Mirroring, Shadowing On-line/near-line/off-line

Insurance Emergency response plans Procedures Training Risk management program

LTU CISP Security 38

The Steps in a BCP - 3

Decision Making Cost effectiveness

Total cost Human intervention requirements

Manual functions are weakest Overrides and defaults

Shutdown capability Default to no access

Design openness Least Privilege

Minimum information Visible safeguards

Entrapment Selected vulnerabilities made attractive

LTU CISP Security 39

The Steps in a BCP - 3

Decision Making Universality Compartmentalization, defense in depth Isolation Completeness Instrumentation Independence of controller and subject Acceptance Sustainability Auditability Accountability Recovery

LTU CISP Security 40

Remedial Measures

Alter environment Erect barriers Improve procedures Early detection Contingency plans Risk assignment (insurance) Agreements Stockpiling Risk acceptance

LTU CISP Security 41

Remedial Measures

Fire Detection, suppression

Water Detection, equipment covers, positioning

Electrical UPS, generators

Environmental Backups

Good housekeeping Backup procedures Emergency response procedures

LTU CISP Security 42

The Steps in a BCP - 3

Plan DevelopmentSpecify resources needed for recoveryTeam-basedRecovery plansMitigation stepsTesting plansPrepared by those who will carry them out

LTU CISP Security 43

Included in a BCP

Off-site storageTrip there - secure? Timely?Physical layout of siteFire protectionClimate controlsSecurity access controlsBackup power

LTU CISP Security 44

Included in a BCP

Off-site storage

Alternate site Reciprocal agreements/Multiple sites/Service bureaus Hot/Warm/Cold(Shell) sites Trip there - secure? Timely? Physical layout of site Fire protection Climate controls Security access controls Backup power Agreements

LTU CISP Security 45

Included in a BCP

Off-site storage Alternate site

Backup processing Compatibility Capacity Journaling - maintaining audit records

Remote journaling - to off-site location Shadowing - remote journaling and delayed mirroring Mirroring - maintaining realtime copy of data Electronic vaulting - bulk transfer of backup files

LTU CISP Security 46

Included in a BCP

Off-site storage Alternate site Backup processing

CommunicationsCompatibilityAccessibilityCapacityAlternatives

LTU CISP Security 47

Included in a BCP

Off-site storage Alternate site Backup processing Communications

Work spaceAccessibilityCapacityEnvironment

LTU CISP Security 48

Included in a BCP

Off-site storage Alternate site Backup processing Communications Work space Office equipment/supplies/documentation Security Critical business processes/Management Testing Vendors - Contact info, agreements Teams - Contact info, transportation Return to normal operations Resources needed

LTU CISP Security 49

Complications

Media/Police/Public Families Fraud Looting/Vandalism Safety/Legal issues Expenses/Approval

LTU CISP Security 50

The Steps in a BCP - Finally

Plan TestingProves feasibility of recovery processVerifies compatibility of backup facilitiesEnsures adequacy of team procedures

Identifies deficiencies in procedures

Trains team membersProvides mechanism for maintaining/updating the

planUpper management comfort

LTU CISP Security 51

The Steps in a BCP - Finally

Plan TestingDesk checks/ChecklistStructured WalkthroughsLife exercises/SimulationsPeriodic off-site recovery tests/ParallelFull interruption drills

LTU CISP Security 52

The Steps in a BCP - Finally

Test Software Hardware Personnel Communications Procurement Procedures Supplies/forms Documentation Transportation Utilities Alternate site processing Security

LTU CISP Security 53

The Steps in a BCP - Finally

Test Purpose (scenario) Objectives/Assumptions Type Timing Schedule Duration Participants

Assignments Constraints Steps

LTU CISP Security 54

The Steps in a BCP - Finally

Alternate Site Test– Activate emergency control center– Notify & mobilize personnel– Notify vendors– Pickup and transport

tapes supplies documentation

– Install (Cold and Warm sites)– IPL– Verify– Run– Shut down/Clean up– Document/Report

LTU CISP Security 55

The Steps in a BCP - Finally

Plan Update and Retest cycle (Plan Maintenance) Critical to maintain validity and usability of plan

Environmental changes HW/SW/FW changes Personnel

Needs to be included in organization plans Job description/expectations Personnel evaluations Audit work plans

LTU CISP Security 56

BCP by Stages

Initiation Current state assessment Develop support processes Training Impact Assessment Alternative selection Recovery Plan development Support services continuity plan development Master plan consolidation Testing strategy development Post transition plan development

LTU CISP Security 57

BCP by Stages

Implementation planning Quick Hits Implementation, testing, maintenance

LTU CISP Security 58

End User Planning

DP is critical to end users Difficult to use manual procedures Recovery is complex Need to plan

manual proceduresrecovery of data/transactionsprocedures for alternate site operationprocedures to return to normal

LTU CISP Security 59

The Real World

DR plans normally involveEssential DP platforms/systems onlyA manual on the shelf written 2-3 years agoLittle or no user involvementNo provision for business processesNo active testingResource lists and contact information that do

not match current realities

LTU CISP Security 60

Stages in an Incident

Disaster interruption affecting user operations

significantly

LTU CISP Security 61

Stages in an Incident

Disaster Initial/Emergency response

Purpose Ensure safety of people Prevent further damage

Activate emergency response team Covers emergency procedures for expected hazards Safety essential Emergency supplies Crisis Management plan - decision making

LTU CISP Security 62

Stages in an Incident

Disaster Initial response Impact assessment

Activate assessment teamDetermine situation

What is affected?

Decide whether to activate plan

LTU CISP Security 63

Stages in an Incident

Disaster Initial response Impact assessment Initial recovery

Initial recovery of key areas at alternate siteDetailed proceduresSalvage/repair - Clean up

LTU CISP Security 64

Stages in an Incident

Disaster Initial response Impact assessment Initial recovery Return to normal/Business resumption

Return to operation at normal site “Emergency” is not over until you are back to normal Requires just as much planning - Parallel operations

LTU CISP Security 65

Special Cases

Y2K Incidents will happen in a particular time

frameAlternate sites won’t helpRedundant equipment won’t helpBackups won’t help Involves automated equipment and services

LTU CISP Security 66

Final Thoughts

Do you really want to activate a DR/BCP plan?PreventionPlanning