Business Continuity & Disaster Recovery
This chapter presents the following: Project initiation steps Recovery and continuity planning requirements Business impact analysis Selecting, developing, and implementing disaster and
continuity plans Backup and offsite facilities Types of drills and tests
Business Continuity & Disaster Recovery
Introduction We can’t prepare for every possibility, as recent events
have proved. The catastrophic Indian Ocean tsunami in December 2004. The terrorists attack on World Trade Center towers.
affected many businesses, people, the government, and the world. Every year, thousands of businesses are affected by floods,
fires, tornadoes, terrorist attacks, and vandalism. The companies that survive are the ones that thought
ahead, planned for the worst, estimated the possible damages that could occur, and put the necessary controls in place to protect themselves and staying in the market.
Business Continuity & Disaster Recovery
Business Continuity and Disaster Recovery Business continuity planning provides methods
and procedures for dealing with longer-term outages and disasters. How do we stay in and continue the business until the
disaster is over and things get back to normal
Disaster recovery is to minimize the effects of a disaster and to take the necessary steps to ensure that the resources, personnel, and business processes are able to resume operation in a timely manner”. Disaster recovery plan is usually very information
technology (IT) focused.
Classification of Disruption
What is a ‘Disruption’? Types of Disruption:
Non-disasters Due to a device malfunction or failure
Disasters Causes the entire facility to be unusable for a day or
longer
Catastrophes Major disruption that destroys the facility altogether
Business Continuity Steps – An Overview Although no specific scientific equation is followed to
create continuity plans, certain best practices have proven themselves over time.
Accordingly following steps are outlined:1. Develop the continuity planning policy statement.
2. Conduct the business impact analysis (BIA). 1. Identify critical functions and systems, prioritize them based on
necessity.
2. Identify vulnerabilities, threats, and calculate risks.
3. Identify preventive controls.
4. Develop recovery strategies.
5. Develop the contingency plan.
6. Test the plan and conduct training and exercises.
7. Maintain the plan.
Develop the Continuity Planning Policy Business continuity should be a part of the
security program and business decisions establishing and maintaining a current continuity
plan with management support. justification of cost and benefit for the activity formation of a BCP Team which includes individuals
from: Business units Senior management IT department Security department Communications department Legal department; etc
Business Impact Analysis (BIA) A business impact analysis (BIA) is a functional
analysis of an organization to develops a hierarchy of business functions; and applies a classification scheme to indicate each individual function’s criticality level.
How do we determine a classification scheme based on criticality levels?
Business Impact Analysis (BIA)Perform the Risk Assessment Calculate Asset Value and Perform Risk Assessment (BIA Step
6 – 7) Same as discussed in Chapter 3
Various Disaster Scenarios The analysis should consider the scenarios that
could produce the following results: Equipment malfunction or unavailable equipment Unavailable utilities (HVAC, power, communications lines) Facility becomes unavailable Critical personnel become unavailable Vendor and service providers become unavailable Software and/or data corruption
Business Impact Analysis (BIA)Estimation of Losses Loss in reputation and public confidence Loss of competitive advantages Increase in operational expenses Violations of contract agreements Violations of legal and regulatory requirements Delayed income costs Loss in revenue Loss in productivity
Identification of Maximum Tolerable Downtime (MTD)
Business Impact Analysis (BIA)Maximum Tolerable Downtime (MTD) The following are some MTD estimates that may
be used within an organization:
System Rating Duration Nonessential 30 days Normal Seven days Important 72 hours Urgent 24 hours Critical Minutes to hours
Preventive Measures
Based on BIA result and calculated MTD the preventive measures are implemented to reduce the impact of risk. They may include some of the following components: Redundant servers and communications links Power lines coming in through different locations Purchasing of UPS and generators Redundant vendor support Purchasing of insurance Data backup technologies Backup media protection safeguards Increased inventory of critical equipment Fire detection and suppression systems
Recovery Strategies
A recovery strategy is a combination of preventive, detective and corrective measures.
The selection of a recovery strategy would depend upon: The criticality of the business process and the applications
supporting the processes Cost Time required to recover Security
It is the most cost-effective recovery mechanisms to address the threats identified in the BIA stage. E.g. If the facility was unavailable for a day, it would cost the
organization $200,000 a day, the company has to be up and running within MTD or the company could be financially crippled.
The company needs to obtain a hot site or redundant facility that would allow it to be up and running in this amount of time.
Recovery Strategies
Recovery strategies might cover the following areas: Business process recovery Facility recovery Supply and technology recovery User environment recovery Data recovery
Recovery Strategies
Business Process Recovery Considering the example of SZABIST:
Course registration through ZABDESK is not available then???
What are the alternates to continue the process?
Also
In the mean time, recover the processes to original state.
Recovery Strategies Facility Recovery
Companies can choose from three main types of leased or rented offsite facilities: Hot Site
Fully configured and ready to operate immediately or within few hours Warm Site
Leased or rented facility that is partially configured with some equipment, but not all the systems and equipments.
Cold Site Leased or rented facility that supplies the basic environment, electrical
wiring, air conditioning, but none of the equipment or additional services.
Reciprocal Agreements Redundant Sites
Speed of availability Subscribers per site and area
Note: Offsite location should be far enough away from the original site so one disaster does not take out both locations
Recovery Strategies
Supply and Technology Recovery Backup solutions for the following:
Network and computer equipment / Hardware
Voice and data communications resources Redundancy
Alternative routing
Human resources
Business Applications, Software and Data
Environment issues (HVAC)
Recovery Strategies
Data Backup Alternatives Full Backup Incremental Backup
Electronic Backup Solutions Offsite backup vaults Disk Mirroring Real time data replication
Insurance
Recovery Strategies
Which solution to go for???Depends on: Maximum Tolerable Downtime (MTD) Recovery Point Objective (RPO) Based on acceptable data loss Indicates earliest point in time in which it is acceptable to
recover the data Recovery Time Objective (RTO) Based on acceptable downtime Indicates earliest point in time at which the business
operations must resume after a disaster
Documentation of Plans
Documentation of formal plans includes: Business Continuity Plan (BCP)
Disaster Recovery Plan (DRP)
Testing and Revising the Plans BCP and DRP should be tested at least once a
year. The following type of tests can be conducted: Checklist Test
Structured Walk-Through Test
Simulation Test
Full-Interruption Test
Maintaining the Plan
The plan developed today might be obsolete in a year due to:
Infrastructure and environnent changes occur.
Reorganization of the company, layoffs, or mergers occur.
Changes in hardware, software, and applications occur.
Plans do not have a direct line to profitability.
Plans should be updated based on the test results