Business Continuity & Crisis Management in the Cyberbreach Age

BusinessContinuity&CrisisManagementintheCyberbreach Age

BryanStrawser,MBCP,MBCI,CISSP,CEMPrincipalConsultant&CEO

4

5

DataBreaches

Company Impacted People

SonyPictures 6,000

SallyBeauty 25,000

NeimanMarcus 1,100,000

Michaels Stores 3,000,000

Community HealthSystems 4,500,000

PFChang’s 7,000,000

HomeDepot 56,000,000

Target 70,000,000

JPMorgan 76,000,000

Anthem 80,000,000

eBay 145,000,000

7

TheLast36Months

Copyright©2015byBryghtpath LLC|bryghtpath.com |+1-612-235-6435|[email protected]

9

10

11

12

Today

• ContinuityofOperations

• Crisis/EmergencyManagement

• CrisisCommunications

• Wheretolearnmore…

• Q&A

13

KeyTopics

ContinuityofOperations

Theabilitytocontinueperformanceofmissionessentialfunctionsundera

broadrangeofcircumstances

14

AnOverview

ContinuityofOperations

• MissionEssentialFunctions(MEFs)– Criticalfunctionsperformedbyyouragency– Determinedthroughamethodology– Plansareinplacetorecoverfromadisruption

• BroadRangeofCircumstances– “All-Hazards”approach– Plans(Annexes)forspecificcircumstances

15

Whatitmeans

GlobalStandards

USGovernment• FEMAFederalContinuityDirectives(FCD1/FCD2)• FEMAContinuityGuidanceCirculars(CGC1/CGC2)• NIST800-34,ContingencyPlanningGuideforFederalInformationSystems

BusinessContinuity• ISO22301(formerlyBS25999)• NFPA1600• ASISBusinessContinuityManagementStandard• ASISSPC.1:OrganizationalResilience

ProfessionalPractices• DisasterRecoveryInstituteInternationalBC/DRProfessionalPractices• BusinessContinuity InstituteGoodPracticeGuide

16

BusinessContinuityandEmergencyManagement

• Federalguidancefornon-Federalgovernmentalentities

• Contents:– PlanningandimplementingaCOOPprogram

– Continuityplanningformissionessentialfunctions

17

FEMAContinuityGuidanceCircular1(CGC1)ContinuityofOperationsProgramforState/Local/TribalGovernment


• Federalguidancefornon-Federalgovernmentalentities

• Contents:– IdentificationandprioritizationofMissionEssentialFunctions(MEF)

– BusinessProcessAnalysis– BusinessImpactAnalysis– RiskAssessment

18

FEMAContinuityGuidanceCircular2(CGC2)ContinuityofOperationsProgramforState/Local/TribalGovernment


BusinessContinuityRegulations

UnitedStates• FederalFinancialInstitutionsExaminationCouncil(FFIEC)• SecuritiesandExchangeCommission(SEC)• FinancialIndustryRegulatoryAuthority(FINRA)• PaymentCardIndustryStandard(PCI)

19

We’refromthegovernment,we’reheretohelp…


20

ContinuityofOperationsLifecycleFEMAContinuityGuidanceCircular1(CGC1)

Plans andProcedures

Test, Training,&Exercises

Evaluations,After-ActionReports,andLessonsLearned

DevelopCorrectiveActionPlans


BusinessImpactAnalysis&RiskAssessmentIdentifyingcriticalbusinessfunctions&theirrisks

BusinessImpactAnalysis• Whatarethemissionessential functionsat

myagency?• Howlongcantheybedisrupted?• Howquicklycantheyberecovered today?• Whatistheimpactfromthatdisruptionto

myagency?• BIAMethods

RiskAssessment• Whataretheriskstothesefunctions?• Whatareourtopenterprise risks?• RiskAssessmentMethods

ThirdParties• Don’tforgetaboutthem…


Specificactionstomanageyourrisksandaddressyour

opportunities

• Prepareyouragencyfordisruption

• DevelopCOOPPlans• ImplementCOOPSolutions

22

PlansandProceduresHowcanIrecovermymissionessentialfunctionsinthetimeperiodneeded?


CoreComponentsofaCOOPPlan

• Roles&Responsibilities• Activationprocess• Managingtheimmediate

consequences• Communicationplan• Recoverprioritizedactivities• Mediaresponse• Processforstandingdown

23

PlansandProceduresContinuityofOperationsPlanning


• People– Whowilldothework?

• Technologies– What,ifany,technologieswill

enablethework?

• Facilities– Wherewilltheworkbedone?

• Communications– Howdowesharethis

information?

24

CorePlanElementsRecoveringOperations


25

Establish&ImplementBCProceduresWhatprocesseswillIfollowinadisruption?

SpecificdefinedprocessesforBusinessContinuity

Examples:• Emergencypreparedness• Governance• Activation


• “DisasterRecovery”generallypertainstotherecoverabilityofITsystems– Applications– Infrastructure

• Mustbecloselylinkedtobusinesscontinuitycapability

• ShouldheavilyutilizetheBIAfindingstoinfluenceatieredrecoverystrategy

26

DisasterRecoveryBusinessContinuityforITSystems


• Allplansshouldbeexercisedatleastannually:– Notification– TableTop– Recovery– Fullyintegrated

• DisasterRecovery– TestingDRplansandstrategies

• GovernmentGuidance:– HomelandSecurityExercise&

EvaluationProgram(HSEEP)

27

Tests,Training,andExercisesHowwillIexerciseandtestmyplans? Basedonthoseresults,howwillIimprove?


• Definedprocessforcapturinglessonslearnedandapplyingtoplansandstrategies

• Actionitemstrackedandreportedupontokeystakeholdersandleaders

28

DevelopCorrectiveActionPlansImprovingplansandproceduresfollowingatestorexercise


29

ContinuityofOperationsLifecycleFEMAContinuityGuidanceCircular1(CGC1)

Plans andProcedures

Test, Training,&Exercises

Evaluations,After-ActionReports,and

Lessons Learned

DevelopCorrectiveAction

Plans


30

ContinuityPlanOperationalPhasesWhathappenswhenthingsgobad?


Readiness&Preparedness Activation Continuity

Operations Reconstitution

RolesandResponsibilities

31

Whodoeswhat?

Copyright©2015byBryghtpathLLC|bryghtpath.com |+1-612-235-6435|[email protected]

• ElectedOfficials– Ultimatelyresponsibleforcontinuityofessentialfunctionsduringa

disruptionoremergency

• SeniorLeadership– DesignatesContinuityManagerandPlanningTeam– Approvesplans

• ContinuityManager– Responsibleforcoordinatingallcontinuityactivitieswithinanagency

• ContinuityPlanningTeam– Crossfunctionalgroupthatcoordinatesallplanswithinanagency

32

Drip,Drip…Whenadripbecomesaflood…


• 2013TargetCorporationHQFlood

• ReadPDFCaseStudyatbryghtpath.com

33

CaseStudyWhenadripbecomesaflood…


34


CrisisManagement

Theactivemanagementofadisruptionorescalatingsituation

Itemstoconsider:• Clearrolesandresponsibilities• Decisionmakingrightspre-defined• Singlesourceoftruthcommunication• Communicationproducts/messages• Cross-functionalcoordination

AComponentofBusinessContinuityManagement


CrisisLeadership

36

Characteristicsofastrongcrisisleader


• Cross-FunctionalLeadership– Leadup(vertically)– Leadacross(horizontally)

• Bebothstrategicandtactical– Strategic:Seetheentireorganizationandexternalinfluences– Tactical:Bewillingtoworkonreallysimpleprocesseswhere

needed• Understandsthatsuccessneverhappenswithinasilo• Doesn’ttrytoget“fancy”• Canpivotinamoment• Possessesextraordinarysituationalawareness

PrivateSectorCrisisManagementFramework

37

SituationalAwareness


ExecutiveCrisisTeam(ElectedLeaders/SeniorLeader)

Cross-FunctionalCrisisTeam(MissionEssentialLeaders)

CrisisManagementTeam

StrategicDecisionMaking

DaytodayoperationsRecommendations toExecutives

HorizontalCommunication

SubjectmatterexpertsSituationalawarenessupstream

Full-time/volunteer

Planning&Preparedness

38

Routinev.Novel


• Don’tgetfancyatfirst– Howwilltheteam“activate”andsharethattheyareactivelymanagingasituation?

– Howwilltheyprovideupdates?– Whatdecisionswillbeescalatedtoexecutives?

• Thengetfancy– Whatcoulddisruptourbusiness?– Prioritizetheseriskswithexecutives– Planforkeyrisks

• REMEMBER:Youcannotplanforeverything• Havingaframeworkismoreimportantthanhavingaplanforeverysinglepossibility

39

CaseStudy:Earthquake&Tsunami– Sendai,Japan(2011)

CrisisManagementFramework

40



RoutineIncidentHOLYS$@!

Whatjusthappened?!

Protocols&ProcessesIncidentSpecificPlansPreparednessSteps

SituationalAwarenessCollaborativecross-functionaldiscussion

StrategicviewFrameworkfor

collaborativedecisionmaking&communication

CrisisLeadership

41



• What’shappening?• Whatdoweknowaboutit?• Whatimpactisithavingonourorganization?• Whatdon’tweknowwhatweneedtoknow?

42

43

PracticalAdvice

44

TheSimpleThings


• Work/Organization– Clearroles&responsibilities– Establishdecisionmakingrights– Howwillyoucommunicate?– SituationalAwareness

• Personal– BeInformed– MakeaPlan– BuildaKit– Visitready.gov formorepracticaladvice

45

46

ReputationImpactHurricaneSandy- 2012


InternationalBusinessTimes–11/3

CrisisCommunications

48

Sendingoutapressreleaseisn’tgoingtocutit


• You’llonlygetonechancetomessagethingswithyourversionofthestory– don’tpassupthisopportunity!

• Slow,methodicalPRplanningwillnotsuffice–communicationsmustbenimble.

• Speed,accuracy,claritywillbecriticalinadatabreach

• Honesty– spinisok,butbehonest.

• Culturalcontextiscritical.

49

50

HowtoLeadduringacrisis

51

EricMcNulty,HarvardBusinessReview,December2013


• Ensurecertaintyaboutdecisionmakingandstrategicmessaging

• UnderstandStakeholders– Mapoutyourstakeholders– Understandeachhasuniqueneedsforinformationandreassurance

– Developstoryarcsforeach

• Understandthatthecrisiswillevolveovertime

52

ContinuityofOperationsTraining

53

FEMAEmergencyManagementInstitute


• FreeFEMAIndependentStudycoursesonline

• http://training.fema.gov/EMI

ContinuityofOperationsCertifications

54

FEMAEmergencyManagementInstitute


• FEMAContinuityofOperations(COOP)Certifications

• Level1:ProfessionalContinuityPractitioner• Seriesof13independentstudyorin-personcourses• Manyin-personcoursescanbetakenthroughMNHomelandSecurity&

EmergencyManagementforfree

• Level2:MasterContinuityPractitioner• CompleteLevel1certification• Complete5additionalindependentstudyandin-personcourses• Instructonecontinuitycourseasaninstructor• Completeandpasscomprehensivewrittenexamination

• Learnmoreathttp://training.fema.gov/programs/COOP

IndustryProfessionalCertifications

BusinessContinuity• DisasterRecoveryInstituteInternational

– AssociateBusiness ContinuityProfessional(ABCP)– CertifiedBusiness ContinuityProfessional(CBCP)– MasterBusiness ContinuityProfessional(MBCP)

• BusinessContinuityInstitute– Member,Business ContinuityInstitute(MBCI)– Fellow,BusinessContinuity Institute(FBCI)

EmergencyManagement• InternationalAssociationofEmergencyManagers

– AssociateEmergencyManager(AEM)– CertifiedEmergencyManager(CEM)

55

BusinessContinuityandEmergencyManagement


ContactInformation

ContactBryan:BryanStrawserPrincipalConsultant&CEOPhone: +1-612-235-6435E-Mail: [email protected]: @bryanstrawser

LearnmoreaboutBryghtpathLLCWebsite: www.bryghtpath.comTwitter: @bryghtpathFacebook: /bryghtpathllc

56

Bryghtpath LLC


OurConsultingServicesInclude:BusinessContinuity

Crisis/EmergencyManagementEnterpriseRiskManagementExerciseDesign&FacilitationGlobalIntelligence&SecurityISOTraining&Certification

Project&ProgramManagementTravelRisk&Security

Date post:	14-Apr-2017
Category:	Leadership & Management
Upload:	bryghtpath-llc
View:	370 times
Download:	2 times

Business Continuity & Crisis Management in the Cyberbreach Age

Leadership & Management