Business Continuity Planning and Disaster Recovery
Business Continuity Planning and Disaster Recovery Business Continuity Planning and Disaster Recovery Katalin Szenes Dr., CISA, CISM, CGEIT, CISSP [email protected] University Óbuda- Óbudai Egyetem Faculty JvN - Neumann János Informatikai Kar Inst. SW Technology - Szoftvertechnológiai Intézet Dr. Szenes 1 Table of Contents • • • • • • • • • • Dr. Szenes purpose and main aspects definitions - BCP, disaster, DRP, IT BCP, IT DRP tasks of the IS auditor example on these tasks: CISA Q no 6-3 on audit concerns: CISA Q no 6-10 Consequences Concerning the Acceptance of the Risks other planning issues preliminaries to be settled preliminaries / insurance emergency management team CISA Q no 6-8 notification priorities CISA Q NO 6-9 organizational unit IT & the BCP 2 1 Business Continuity Planning and Disaster Recovery Table of Contents z On the Components of the Information Systems Business Continuity Plan o some [development] phases o [development] process o o categories of incidents & incident management BIA & risk management system risk ranking issues in BIA phase questions in BIA phase example on risk aspects CISA Q no 6-1 - answer: see ISO/IEC 27001, 2, too Dr. Szenes 3 Table of Contents z On the Components of the Information Systems Business Continuity Plan - cont'd o o Dr. Szenes BCP documents Infrastructure types - hot, warm, etc. provisions for 3rd party agreements on the audit of 3rd party agreements infrastructure / telecommunications, networks infrastructure / storage 4 2 Business Continuity Planning and Disaster Recovery Table of Contents • • • • • • • BCP plan - testing considerations rulebook contents recovery aspects (RPO, RTO, etc.) The IS BCP of the Individual Systems COBIT 3, 4 support of IS audit and IT security the processes of Delivery & Support DS4 - Ensure Continuous Service DS4 control objectives ISACA CRM case study references Dr. Szenes 5 purpose and main aspects (forrás, többek között: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) purpose: z to enable a business to continue offering critical services in the event of a disruption and to survive even a disastrous interruption of its activities the business continuity planning has to take into consideration: z the market & strategy goals of the corporate Î z the strategic business processes Î z those key operations that are most necessary to the survival of the organization z the human/material resources supporting them Note: z ?? business continuity plan must be based on the long-range IT plan ?? Dr. Szenes 6 3 Business Continuity Planning and Disaster Recovery purpose and main aspects (forrás, többek között: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) the business continuity plan includes: z the disaster recovery plan to recover a facility rendered inoperable, including relocating operations into a new location - for later use z the restoration plan that is used to return operations to normality whether in a restored or new facility - only after mitigating the effect of the disruption by restarting the business applications involved Dr. Szenes 7 Business Continuity Planning - Definition The purpose of business continuity planning is to enable a business to continue operations should any kind of disturbance arise. Rigorous planning and commitment of resources is necessary to adequately plan for such an event. Business continuity planning is primarily the responsibility of senior management as they are entrusted with the safeguarding of both the assets and the viability of the company. The business continuity planning is to take into consideration: • those key operations that are utmostly necessary to the survival and later to the market success of the organizations • the human / material resources supporting them. Dr. Szenes 8 4 Business Continuity Planning and Disaster Recovery Business Continuity Planning - Definition The second part, the operations part of the business continuity plan should address all functions and assets required to continue as a viable organization and to keep acquiring market sucess. The extent of provision for reserve facilities depends on the cost / effectivity considerations of the top management. Dr. Szenes 9 Disaster Recovery Plan - Definition Disasters are disruptions that cause critical information resources to be inoperative for a period of time, e.g. (weather, terrorism, disruption in expected services, human error, etc.) (this disaster def. & examples are from the CISA® Review Course transparents) The business continuity plan includes: • the disaster recovery plan that is generally the plan to be followed by the business units to recover a harmed / demolished facility or business functionality, or an operational facility and • the operations plan that is to be followed by the business units to "get by" while recovery is taking place. Dr. Szenes 10 5 Business Continuity Planning and Disaster Recovery Information Systems Business Continuity Planning / Information Systems Disaster Recovery Plan - Definition Everything is the same as in the case of the Business Continuity Planning / Disaster Recovery Plan with the exception that the continuity of the information systems processing is threatened. Information systems processing is one operations of many that keep the organization not only alive but also successful thus it is of strategic importance. Thus the event to be controlled is such a disruption and the objective of the control measure is to survive an interruption of the information systems processing. Dr. Szenes 11 Information Systems Business Continuity Planning / Information Systems Disaster Recovery Plan - Definition Throughout the planning process of business continuity the overall plan of the organization should be taken into consideration. All IS plans must be consistent with and support the corporate business continuity plan. This means that especially those information processing systems must have the more elaborated and ready-to-start reserve processing facilities that support key operations. Dr. Szenes 12 6 Business Continuity Planning and Disaster Recovery the tasks of the auditor (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery / Learning Objectives) the tasks of the auditor: z Evaluate the adequacy of backup and restore provisions to ensure the availability of information required to resume processing z Evaluate the organization's disaster recovery plan to ensure that it enables the recovery of IT processing capabilities in the event of a disaster z Evaluate the organization's business continuity plan to ensure the organization's ability to continue essential business operations during the period of an IT disruption ./. Dr. Szenes 13 the tasks of the auditor (forrás, többek között: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) the tasks of the auditor - cont'd z Check if the BCP follows corporate strategy z Evaluate plans for { accuracy { adequacy { effectiveness { etc. Evaluate offsite storage z Evaluate ability of IS and user personnel to respond effectively z Ensure plan maintenance is in place z Evaluate readability of business continuity manuals and procedures ./. Dr. Szenes 14 7 Business Continuity Planning and Disaster Recovery the tasks of the auditor (forrás, többek között: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) the tasks of the auditor - cont'd z Check the documents from the viewpoint of Currency Effectiveness Validity: interview personnel for appropriateness and completeness z Evaluate the BCP quality, e.g.: Determine whether corrective actions are in the plan Evaluate thoroughness and accuracy Determine problem trends and resolution of problems ./. Dr. Szenes 15 the tasks of the auditor (forrás, többek között: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) the tasks of the auditor - cont'd z Evaluate media & documentation handling: { presence, { synchronization and { currency of media and documentation z Perform a detailed inventory review z Review all documentation { is it current, is it detailed enough? { change management { configuration management ./. Dr. Szenes 16 8 Business Continuity Planning and Disaster Recovery the tasks of the auditor (forrás, többek között: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) the tasks of the auditor - cont'd z Evaluate offsite storage facility { if any, and what is there? { evaluate the physical and environmental access controls { examine the equipment for current inspection and calibration tags { etc. z Key personnel must have an understanding of their responsibilities ./. Dr. Szenes 17 the tasks of the auditor (forrás, többek között: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) questions for checking: { Who is responsible for administration or coordination of the plan? { Is the plan administrator/coordinator responsible for keeping the plan up-to-date? { Is there a disaster recovery implementation team (i.e., the first response team members who will react to the emergency with immediate action steps)? { Where is the disaster recovery plan stored? { What critical systems are covered by the plan? { What systems are not covered by the plan? Why not? ./. Dr. Szenes 18 9 Business Continuity Planning and Disaster Recovery the tasks of the auditor (forrás, többek között: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) questions for checking - cont'd { What equipment is not covered by the plan? Why not? { Does the plan operate under any assumptions? What are they? { Does the plan identify rendezvous points for the disaster management committee or emergency management team to meet and decide if business continuity should be initiated? { Are the documented procedures adequate for successful recovery? { Does the plan address disasters of varying degrees? { Are telecommunication’s backups (both data and voice line backups) addressed in the plan? z and how? - see later: infrastructure / telecommunications ./. Dr. Szenes 19 the tasks of the auditor (forrás, többek között: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) questions for checking - cont'd { Is there a backup facility site? and / or: what kind of precautions are made? (see later: different types of infrastructures) { Does the plan address relocation to a new information processing facility in the event that the original center cannot be restored? { Does the plan include procedures for z merging master file data, z automated tape management system data, z etc., into pre-disaster files? Dr. Szenes 20 10 Business Continuity Planning and Disaster Recovery the tasks of the auditor - CISA Q no 6-3 (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) An IS auditor should be involved in: z A. observing tests of the disaster recovery plan. z B. developing the disaster recovery plan. z C. maintaining the disaster recovery plan. z D. reviewing the disaster recovery requirements of supplier contracts. Dr. Szenes 21 the tasks of the auditor - CISA Q no 6-3 (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) Answer: A z The IS auditor should always be present when disaster recovery plans are tested to ensure that the test meets the required targets for restoration, ensure that recovery procedures are effective and efficient, and report on the results, as appropriate. z IS auditors may be involved in overseeing plan development, but they are unlikely to be involved in the actual development process. z Similarly, an audit of plan maintenance may be conducted, but the IS auditor normally would not have any responsibility for the actual maintenance. z An IS auditor may be asked to comment upon various elements of a supplier contract, but, again, this is not always the case. Dr. Szenes 22 11 Business Continuity Planning and Disaster Recovery on audit concerns - CISA Q no 6-10 (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) version 1 - the transparents In an audit of a business continuity plan, which of the following findings is of MOST concern? z A. There is no insurance for the addition of assets during the year. z B. The business continuity plan manual is not updated on a regular basis. z C. Testing of the backup data has not been done regularly. z D. Records for maintenance of the access system have not been maintained. Dr. Szenes 23 on audit concerns - CISA Q no 6-10 (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) version 1 - the transparents The correct answer is C z The most vital assets for a company are data. In a business continuity plan, it is critical to ensure that data are available. Therefore, regular testing of the backup of data must be done. If testing is not done, the organization may not be able to retrieve data when required during a disaster; hence, the company may lose its most valuable asset and may not be able to recover from the disaster. z A loss on account of lack of insurance is limited to the value of assets. z If the business continuity plan manual is not updated, the company may find the manual not fully relevant for recovery during a disaster. However, recovery could be still possible. z Non-maintenance of records in an access system will not directly impact the relevance of the business continuity plan. Dr. Szenes 24 12 Business Continuity Planning and Disaster Recovery on audit concerns - CISA Q no 6-10 (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) version 2 In an audit of a business continuity plan, which of the following findings is of MOST concern? z A. There is no insurance for the addition of assets during the year. z B. The business continuity plan is not updated on a regular basis. z C. Testing of the backup data has not been done regularly. z D. Records for maintenance of the access system have not been maintained. The correct answer is? Dr. Szenes 25 Consequences Concerning the Acceptance of the Risks The alternatives of the elimination of the risks are determined by the resources that the management wants to spend on the "safety". The management classifies according to business importance the assets processes data and the data processing systems importance is equal to the importance of the element they support. • • • Dr. Szenes 26 13 Business Continuity Planning and Disaster Recovery other planning issues (forrás -többek közt: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) the entire organization needs to be considered for BCP the personnel has to z classify critical systems, resources z to determine acceptable recovery times z react the personnel who must react to the interruption/disaster scenarios are those who are responsible for the most critical resources Î management and user involvement is vital to the success of the business continuity plan Dr. Szenes 27 other planning issues (forrás -többek közt: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) User management involvement is essential to the identification of critical systems, their associated critical recovery times and the specification of needed resources. z The three major divisions that require involvement in the formulation of the business continuity plan are { support services, { business operations and { information processing support. z as the underlying purpose of business continuity planning is the resumption of business operations, every organizational unit should give aspects / and or /help in the development of the BCP, IT BCP, etc., already in the planning phase Dr. Szenes 28 14 Business Continuity Planning and Disaster Recovery other planning issues (forrás -többek közt: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) the BCP, IT BCP, etc., are to be based on z the risk assessment results, and the BIA z the business goals & strategy z all issues involved in interruption to business processes, z including recovering from a disaster Important: z The plan should be documented and written in a simple language understandable to all. z Copies of the plan should be maintained offsite. Dr. Szenes 29 other planning issues (forrás -többek közt: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) to the BCP, IT BCP, etc., the following other info are to be collected: z Pre-disaster readiness z possible Evacuation procedures z Circumstances under which a disaster should be declared z Identification of contract informations z Recovery option explanations z Identification of resources for recovery and continued operation of the organization z Dr. Szenes 30 15 Business Continuity Planning and Disaster Recovery preliminaries to be settled (forrás -többek közt: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) to the BCP, IT BCP, etc., the followings should be agreed upon: z z z z z z z z z z z z The policies that will govern all of the continuity and recovery efforts The goals/requirements/products for each phase Alternate facilities to perform tasks and operations Critical information resources to deploy (e.g., data and systems) Persons responsible for completion Available resources to aid in deployment (including human) The scheduling of activities with priorities established Key decision-making personnel Backup of required supplies Telecommunication networks disaster recovery methods Redundant array of inexpensive disks (RAID) Insurance ( . / . Dr. Szenes 31 preliminaries / insurance (forrás -többek közt: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) Most insurance covers only financial losses, based upon the historical level of performance and not the existing level of performance. Also, insurance does not compensate for loss of image/goodwill. The Business Continuity Plan should contain: z key information about the organization's insurance. z it should take the corporate physical, logical, market, etc. environment into consideration z etc. IT BCP: z The information systems processing insurance policy is usually a multi-peril policy designed to provide various types of IS coverage. z It should be modularly constructed in modules, so that it can be adapted to the insured’s particular IT architecture, and requirements, z etc. Dr. Szenes 32 16 Business Continuity Planning and Disaster Recovery preliminaries / insurance (forrás -többek közt: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) (BCP / IT BCP) insurance is to cover, among others: z actual costs of recovery z replacement / reconstruction of every kind of equipment and facilities z IT losses, e.g. { IS Media & software & ... reconstruction z Extra expense z Business interruption z Valuable papers and records z Errors and omissions z Fidelity coverage z Media transportation z etc., other kind of costs of business continuity Dr. Szenes 33 emergency management team (forrás -többek közt: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) The emergency management team coordinates the activities of all other recovery teams. This team oversees: • Retrieving critical and vital data from offsite storage • Installing and • testing systems software and applications at the systems recovery • Identifying, purchasing, and installing hardware at the system recovery site • Operating from the system recovery site • Rerouting network communications traffic • ./. Dr. Szenes 34 17 Business Continuity Planning and Disaster Recovery emergency management team (forrás -többek közt: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) • emergency management team -cont'd • Reestablishing the user/system network • Transporting users to the recovery facility • Reconstructing databases • Supplying necessary office goods, i.e., special forms, check stock, paper • Arranging and paying for employee relocation expenses at the recovery facility • Coordinating systems use and employee work schedules • etc.! Dr. Szenes 35 CISA Q NO 6-8 notification priorities (forrás -többek közt: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) In a business continuity plan, which of the following notification directories is the MOST important? z z z z Dr. Szenes A. B. C. D. Equipment and supply vendors Insurance company agents Contract personnel services A prioritized contact list 36 18 Business Continuity Planning and Disaster Recovery CISA Q NO 6-8 notification priorities (forrás -többek közt: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) The correct answer is D z A prioritized list of contacts is most important since it will direct the process of communication and contact to various entities in order of priority. z Choices A, B and C are musts, but not as important as choice D. Dr. Szenes 37 CISA Q NO 6-9 organizational unit IT & the BCP (forrás -többek közt: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) Which of the following components of a business continuity plan is PRIMARILY the responsibility of an organization’s IS department? Dr. Szenes z A. Developing the business continuity plan z B. Selecting and approving the strategy for the business continuity plan z C. Declaring a disaster z D. Restoring the IS systems and data after a disaster 38 19 Business Continuity Planning and Disaster Recovery CISA Q NO 6-9 organizational unit IT & the BCP (forrás -többek közt: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) The correct answer is D z The correct choice is restoring the IT systems and data after a disaster. The IT department of an organization is primarily responsible for restoring the IT systems and data after a disaster at the earliest possible time. z Members of the organization’s senior management are primarily responsible for developing the business continuity plan for an organization. Management is also responsible for selecting and approving the strategy for developing and implementing a detailed business continuity plan. The organization should identify a person in management as responsible for declaring a disaster. Although IT is involved in the three other choices, it is not primarily responsible for them. Dr. Szenes 39 On the Components of the Information Systems Business Continuity Plan - considerations only ! z [some] phases of development (forrás, többek között: CISA® Review Course transparents, ISACA 2010 ) based on business impact analysis creation of a business continuity and disaster recovery policy classification of operations and criticality analysis forming responsible teams and nominating responsible employees and collecting their calling data development of a business continuity plan and disaster recovery procedures, and { training and awareness program { implementation of the plan { regular testing and monitoring { { { { { { { Dr. Szenes 40 20 Business Continuity Planning and Disaster Recovery On the Components of the Information Systems Business Continuity Plan - considerations only ! z planning [or rather: development] process (forrás: CISA® Review Course transparents, ISACA 2010 ) Dr. Szenes 41 categories of incidents & incident management (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) { Negligible incidents are those causing no perceptible or significant damage, such as very brief operating system (OS) crashes with full information recovery or momentary power outages with uninterruptible power supply (UPS) backup. { Minor events are those that, while not negligible, produce no negative material (of relative importance) or financial impact. { Major incidents cause a negative material impact on business processes and may affect other systems, departments or even outside clients. { Crisis is a major incident that can have serious material (of relative importance) impact on the continued functioning of the business and may also adversely impact other systems or third parties. The severity of the impact depends on the industry and circumstances, but is generally directly proportional to the time elapsed from the inception of the incident to incident resolution. Dr. Szenes 42 21 Business Continuity Planning and Disaster Recovery categories of incidents & incident management (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) Dr. Szenes 43 On the Components of the Information Systems Business Continuity Plan - considerations only ! BIA and risk management z CISA CRM: Business Impact Analysis (BIA) risk management Ù business continuity plan development: z risk assessment includes: system risk ranking ranking: z Critical z Vital z Sensitive z Non-sensitive ranking in details: Dr. Szenes 44 22 Business Continuity Planning and Disaster Recovery On the Components of the Information Systems Business Continuity Plan - considerations only ! BIA and risk management (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) system risk ranking: z Critical – These functions cannot be performed unless they are replaced by identical capabilities. Critical applications cannot be replaced by manual methods. Tolerance to interruption is very low; therefore, cost of interruption is very high. z Vital – These functions can be performed manually, but only for a brief period of time. There is a higher tolerance to interruption than with critical systems and, therefore, somewhat lower costs of interruption, provided that functions are restored within a certain time frame (usually five days or less). ./. Dr. Szenes 45 On the Components of the Information Systems Business Continuity Plan - considerations only ! BIA and risk management (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) system risk ranking - cont'd z Sensitive – These functions can be performed manually, at a tolerable cost and for an extended period of time. While they can be performed manually, it usually is a difficult process and requires additional staff to perform. z Non-sensitive – These functions may be interrupted for an extended period of time, at little or no cost to the company, and require little or no catching up when restored. Dr. Szenes 46 23 Business Continuity Planning and Disaster Recovery On the Components of the Information Systems Business Continuity Plan - considerations only ! BIA and risk management issues in BIA phase z consequences on BCP, that is, on: { alternatives - see infrastructure types { recovery strategies & methods z risk management cycle Dr. Szenes 47 On the Components of the Information Systems Business Continuity Plan - considerations only ! BIA and risk management questions in BIA phase (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) z What are the different business processes? z What are the critical information resources related to an organization’s critical business processes? z What is the critical recovery time period for information resources in which business processing must be resumed before significant or unacceptable losses are suffered? Dr. Szenes 48 24 Business Continuity Planning and Disaster Recovery On the Components of the Information Systems Business Continuity Plan example on the risk aspect - CISA Q (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery ) 6-1 During an audit of a large bank, the IS auditor observes that no formal risk assessment exercise has been carried out for the various business applications to arrive at their relative importance and recovery time requirements. The risk to which the bank is exposed is that the: z business continuity plan may not have been calibrated to the relative risk that disruption of each application poses to the organization. z business continuity plan may not include all relevant applications and, therefore, may lack completeness in terms of its coverage. z business impact of a disaster may not have been accurately understood by the management. z business continuity plan may lack an effective ownership by the business owners of such applications. Dr. Szenes 49 On the Components of the Information Systems Business Continuity Plan example on the risk aspect - CISA Q (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) 6-1 Answer: A z The first and key step in developing a business continuity plan is a risk assessment exercise that analyzes the various risks that an organization faces and the impact of non-availability of individual applications. z ISO: [I refer to 27001,2 ] Dr. Szenes 50 25 Business Continuity Planning and Disaster Recovery On the Components of the Information Systems Business Continuity Plan example on the risk aspect - CISA Q (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) ISO reference to 6-1 Answer /1 27002: Chapter 14: BUSINESS CONTINUITY MANAGEMENT 14.1 INFORMATION SECURITY ASPECTS OF BUSINESS CONTINUITY MANAGEMENT z 14.1.1 Including information security in the business continuity management process z 14.1.2 Business continuity and risk assessment. z 14.1.3 Developing and implementing continuity plans including information security 14.1.4 Business continuity planning framework. z 14.1.5 Testing, maintaining and re-assessing business continuity plans on the standard, see the references ! to buy: www.mszt.hu ! Dr. Szenes 51 On the Components of the Information Systems Business Continuity Plan example on the risk aspect - CISA Q (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) ISO reference to 6-1 Answer /2 27001: Annex A -Control Objectives and Control [Measure]s A.14 Business continuity management A.14.1 Information security aspects of business continuity management z Objective: To counteract interruptions to business activities and to protect critical business processes from the effects of major failures of information systems or disasters and to ensure their timely resumption. z see control measures A.14.1.1 - A.14.1.5 ! on the standard, see the references ! to buy: www.mszt.hu ! Dr. Szenes 52 26 Business Continuity Planning and Disaster Recovery On the Components of the Information Systems Business Continuity Plan (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) BCP documents • • • • • • • • Continuity of operations plan (COOP) Disaster recovery plan (DRP) Business resumption plan Continuity of support plan / IT contingency plan Crisis communications plan Incident response plan Transportation plan Occupant emergency plan (OEP) Dr. Szenes 53 On the Components of the Information Systems Business Continuity Plan - considerations only ! z Infrastructure Types: o Mirroring o Hot, Warm or Cold Site o Alternative Hardware o Backup of Required Supplies o Telecommunication Networks o Servers, Storage o Offsite Libraries and Library Controls o Security and Control of Offsite Facilities o Media and Documentation Backup o etc. details: . / . Dr. Szenes 54 27 Business Continuity Planning and Disaster Recovery infrastructure types (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) z Mirroring [ parallel processing - special HW or organized] z Hot Sites – They are fully configured and ready to operate within several hours. The equipment, network and systems software must be compatible with the primary installation being backed up. The only additional needs are staff, programs, data files and documentation. New definition for hot site: z The hot site is intended for emergency operations of a limited time period and not for long-term extended use. Long-term use would impair the protection of other subscribers. cont'd with consequences ./. Dr. Szenes 55 infrastructure types (forrás, többek között: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) consequences of the new definition: z Therefore, the hot site should be viewed as a means of accomplishing the continuation of essential operations for a period of up to several weeks following a disaster or major emergency. Further plans are still necessary to provide for subsequent operations. z Several vendors offer warm- or cold-site facilities for a subscriber to migrate to after recovery of operations has been completed. This will free up the hot site for use by other subscribers. cold site defintion also new, with suscribers! Dr. Szenes 56 28 Business Continuity Planning and Disaster Recovery infrastructure types (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) warm site: z Warm Sites – They are partially configured, usually with network connections and selected peripheral equipment, such as disk drives, tape drives and controllers, but without the main computer. Sometimes a warm site is equipped with a less powerful central processing unit (CPU), than the one generally used. The assumption behind the warm site concept is that the computer can usually be obtained quickly for emergency installation (provided it is a widely used model) and, since the computer is the most expensive unit, such an arrangement is less costly than a hot site. After the installation of the needed components, the site can be ready for service within hours; however, the location and installation of the CPU and other missing units could take several days or weeks. Dr. Szenes 57 infrastructure types (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) z Cold Sites – These are sites that have only the basic environment (electrical wiring, air conditioning, flooring, etc.) to operate an IPF reducing the cost. The cold site is ready to receive equipment but does not offer any components at the site in advance of the need. Activation of the site may take several weeks. z Duplicate (redundant) Information Processing Facility – These are dedicated, self-developed recovery sites that can backup critical applications. They can range in form from a standby hot site to a reciprocal agreement with another company installation. Dr. Szenes 58 29 Business Continuity Planning and Disaster Recovery infrastructure types (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) z Mobile Sites – This is a specially designed trailer that can be quickly transported to a business location or to an alternate site to provide a readyconditioned information processing facility. z Reciprocal Agreement-with other organizations – This is a less frequently used method between two or more organizations with similar equipment or applications. Under the typical agreement, participants promise to provide computer time to each other when an emergency arises. provisions for 3rd party agreements . / . Dr. Szenes 59 infrastructure / provisions for 3rd party agreements (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) z Configurations—Are the vendor’s hardware and software configurations adequate to meet company needs since these will vary over time? z Disaster—Is the definition of disaster broad enough to meet anticipated needs? z Speed of availability—How soon after a disaster will facilities be available? z Subscribers per site—Does the agreement limit the number of subscribers per site? z Subscribers per area—Does the agreement limit the number of subscribers in a building or area? z Preference—Who gets preference if there are common or regional disasters? Is there backup for the backup facilities? Is use of the facility exclusive or does the customer have to share the available space if multiple customers simultaneously declare a disaster? Does the vendor have more than one facility available for subscriber use? Dr. Szenes 60 30 Business Continuity Planning and Disaster Recovery infrastructure / provisions for 3rd party agreements (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) z Insurance—Is there adequate insurance coverage for company employees at the backup site? Will existing insurance reimburse those fees? z Usage period—How long is the facility available for use? Is this period adequate? What technical support will the site operator provide? Is this adequate? z Communications—Are the communications adequate? Are the communication connections to the backup site sufficient to permit unlimited communication with the alternate site if needed? Dr. Szenes 61 infrastructure / provisions for 3rd party agreements (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) z Warranties—What warranties will the vendor make regarding availability of the site and the adequacy of the facilities? Are there liability limitations (there usually are) and is the company willing to live with them? z Audit—Is there a right-to-audit clause permitting an audit of the site to evaluate the logical, physical and environmental security? z Testing—What testing rights are included in the contract? Check with the insurance company to determine any reduction of premiums that may be forthcoming due to the backup site availability. z Reliability—Can the vendor attest to the reliability of the site(s) being offered? Ideally, the vendor should have a UPS, limited subscribers, sound technical management, and guarantees of computer hardware and software compatibility. Dr. Szenes 62 31 Business Continuity Planning and Disaster Recovery on the audit of 3rd party agreements (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) z An IS auditor should obtain a copy of the contract with the vendor. z Ensure that the contract is written clearly and is understandable. z Reexamine and confirm the organization’s agreement with the rules that apply to sites shared with other subscribers. z Ensure that insurance coverage ties in with and covers all (or most) expenses of the disaster. z Ensure that tests can be performed at the hot site at regular intervals. z Review and evaluate communications requirements for the backup site. z Ensure that enforceable source code escrow is reviewed by a lawyer specializing in such contracts. z Determine the limitation recourse tolerance in the event of a breached agreement. z The contract should be reviewed against a number of guidelines { Contract is clear and understandable { Organization’s agreement with the rules { etc. Dr. Szenes 63 infrastructure / telecommunications, networks (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) z [measures concerning networks include]: – Alternative routing – Diverse routing – Long-haul network diversity – Protection of the local loop [wire between the local switch and the end-user customer] { – Voice recovery { – Availability of appropriate circuits and adequate bandwidth { { { { details: . Dr. Szenes /. 64 32 Business Continuity Planning and Disaster Recovery infrastructure / telecommunications, networks (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) details on the methods of providing telecommunications continuity: z Redundancy—Involves providing extra capacity with a plan to use the surplus capacity should the normal primary transmission capability not be available. In the case of a LAN, a second cable could be installed through an alternate route for use in the event the primary cable is damaged. z Alternative routing—The method of routing information via an alternate medium such as copper cable or fiber optics. This involves use of different networks, circuits or end points should the normal network be unavailable. z Diverse routing—The method of routing traffic through split cable facilities or duplicate cable facilities. This can be accomplished with different and/or duplicate cable sheaths. Dr. Szenes 65 infrastructure / telecommunications, networks (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) details on the methods of providing telecommunications continuity - cont'd z Long haul network diversity—Many recovery facilities vendors have provided diverse long-distance network availability utilizing T1 circuits among the major long-distance carriers. This ensures long-distance access should any one carrier experience a network failure. Several of the major carriers have now installed automatic re-routing software and redundant lines that provide instantaneous recovery should a break in their lines occur. [T1 is what telephone companies have traditionally used to transport digitized telephone conversations between central offices T2, T3 more than 1 T1 multiplexed Î higher speed] Dr. Szenes 66 33 Business Continuity Planning and Disaster Recovery infrastructure / telecommunications, networks (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) details on the methods of providing telecommunications continuity - cont'd z Last mile circuit protection—Many recovery facilities provide a redundant combination of local carrier T1s, microwave and/or coaxial cable access to the local communications loop. This enables the facility to have access during a local carrier communication disaster. Alternate local carrier routing is also utilized. z Voice recovery—With many service, financial and retail industries dependent on voice communication, redundant cabling and alternative routing should be provided for voice communication lines as well as data communication lines. Dr. Szenes 67 infrastructure / storage (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) Redundant array of inexpensive disks (RAID) • Provide performance improvements and fault tolerant capabilities via hardware or software solutions • Provide the potential for cost-effective mirroring offsite for data back-up Dr. Szenes 68 34 Business Continuity Planning and Disaster Recovery infrastructure (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) Q 6-7 An IS auditor discovers that an organization’s business continuity plan provides for an alternate processing site that will accommodate 50 percent of the primary processing capability. Based on this, which of the following actions should the IS auditor take? z A - Do nothing, because generally, less than 25 percent of all processing is critical to an organization’s survival and the backup capacity, therefore, is adequate. z B - Identify applications that could be processed at the alternate site and develop manual procedures to back up other processing. z C - Ensure that critical applications have been identified and that the alternate site could process all such applications. z D - Recommend that the information processing facility arrange for an alternate processing site with the capacity to handle at least 75 percent of normal processing. Dr. Szenes 69 infrastructure (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) Q 6-7 The correct answer is C z A business continuity plan should provide for the recovery of critical systems, not necessarily all systems. z Perhaps only 50 percent of the company’s systems are critical; therefore, careful assessment of critical systems and capacity requirements should be part of the IS auditor’s test of the plan. Dr. Szenes 70 35 Business Continuity Planning and Disaster Recovery BCP plan - testing considerations (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) one of the purposes of the business continuity test is to determine how well the plan works or which portions of the plan need improvement. the test must simulate actual processing conditions z The test should be scheduled during a time that will minimize disruptions to normal operations. Weekends are generally a good time to conduct tests. z It is important that the key recovery team members be involved in the test process and allotted the necessary time to put their full effort into it. z The test should address all critical components and z simulate actual primetime processing conditions, even if it is conducted in off hours. z Test Execution – . /. Dr. Szenes 71 BCP plan - testing considerations (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) the test - cont'd z Test Execution – To perform testing, each of the following test phases should be completed: Pretest, Test, Post-Test. z Documentation of Results – During every phase of the test, detailed documentation of observations, problems and resolutions should be maintained. z Results Analysis – It is important to have ways to measure the success of the plan and test against the stated objectives. Therefore, results must be quantitatively gauged as opposed to an evaluation based only on observation. z Recovery/Continuity plan maintenance – Plans and strategies for business continuity should be reviewed and updated on a scheduled basis to reflect continuing recognition of changing requirements. Dr. Szenes 72 36 Business Continuity Planning and Disaster Recovery On the Components of the Information Systems Business Continuity Plan - considerations only ! Rulebook Contents z z z z z - some of the important points Detailed Plan Organization and Assignment of Responsibilities Emergency Response Team Key Decision-making Personnel what will employees do? - CISA® Review Course transparents were also used here { where will employees report to work, { how will orders be taken while the computer system is being restored, { who is responsible that which vendors should be called to provide needed supplies Dr. Szenes 73 On the Components of the Information Systems Business Continuity Plan - considerations only ! Rulebook Contents - some of the important points z z Insurance z Recovery/Continuity Plan Testing: { Plan and Actual Tests { Documentation of the Test Results { Results Analysis z xx Dr. Szenes 74 37 Business Continuity Planning and Disaster Recovery On the Components of the Information Systems Business Continuity Plan - considerations only ! Rulebook Contents z z z z z - cont'd Recovery/Continuity Plan Maintenance Periodic Backup Procedures Record Keeping for Offsite Storage xx Dr. Szenes 75 recovery aspects (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery z z z z z z Recovery Point Objective (RPO) Recovery Time Objective (RTO) Interruption window Service delivery objective - SDO Maximum tolerable outage Disaster tolerance Dr. Szenes 76 38 Business Continuity Planning and Disaster Recovery recovery aspects (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery disaster here: disaster AFTER the interrupt Recovery Point Objective (RPO) { Based on acceptable data loss { Indicates earliest point in time in which it is acceptable to recover the data z acceptable data loss: For example, if the process can afford to lose the data up to four hours before disaster, then the latest backup available should be up to four hours before disaster or interruption and the transactions during RPO and interruption need to be entered after recovery (known as catch-up data). Dr. Szenes 77 recovery aspects (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery disaster here: disaster AFTER the interrupt - ?? Recovery Point Objective (RPO) { Based on acceptable data loss { Indicates earliest point in time in which it is acceptable to recover the data z RPO effectively quantifies the permissible amount of data loss in case of interruption. It is almost impossible to recover the data completely. Even after entering catch-up data, some data are still lost and are referred to as orphan data. z If RPO is very low, say in minutes, it means that the process cannot afford to lose the data in such a short time. In such cases, data mirroring should be used as a recovery strategy. If RPO is high, say in hours, then other backup procedures, such as reel backup, could be used. Dr. Szenes 78 39 Business Continuity Planning and Disaster Recovery recovery aspects (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery disaster here: disaster caused by the interrupt z Recovery Time Objective (RTO) { Based on acceptable downtime { Indicates earliest point in time at which the business operations must resume after a disaster z The RTO is determined based on the acceptable downtime in case of a disruption of operations. It indicates the earliest point in time at which the business operations must resume after disaster. z A high RTO will mean that so much additional time would be available for the recovery strategy. Dr. Szenes 79 recovery aspects (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery relation between RPO / RTO - which recovery strategies would be best with different RTO and RPO parameters? Dr. Szenes 80 40 Business Continuity Planning and Disaster Recovery recovery aspects (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery z Interruption window—The time the organization can wait from the point of failure to the critical services/applications restoration. After this time, the progressive losses caused by the interruption are unaffordable. z Service delivery objective (SDO)—Level of services to be reached during the alternate process mode until the normal situation is restored. This is directly related to the business needs. z Maximum tolerable outages—Maximum time the organization can support processing in alternate mode. After this point, different problems may arise, especially if the alternate SDO is lower than the usual SDO, and the information pending to be updated can become unmanageable. z Disaster tolerance is the time gap within which the business can accept non-availability of IT facilities. If this time gap is high, recovery strategies that take a longer time can be used. Dr. Szenes 81 recovery aspects (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery Q 6-5 Data mirroring should be implemented as a recovery strategy when: Dr. Szenes z A. recovery point objective (RPO) is low. z B. RPO is high. z C. recovery time objective (RTO) is high. z D. disaster tolerance is high. 82 41 Business Continuity Planning and Disaster Recovery recovery aspects (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery Q 6-5 The correct Answer is A z z z z RPO is the earliest point in time to which it is acceptable to recover the data. If RPO is very low, say in minutes, it means that the process cannot afford to lose the data in such a short time. In such cases, data mirroring should be used as a recovery strategy. If RPO is high, say in hours, then other backup procedures, such as reel backup, could be used. A high RTO will mean that so much additional time would be available for the recovery strategy. Disaster tolerance is the time gap within which the business can accept non-availability of IT facilities. If this time gap is high, recovery strategies that take a longer time can be used. Dr. Szenes 83 The IS BCP of the Individual Systems The most important part of the business continuity plan consists of those of the individual systems. The table of contents of the systems business continuity plan contains (at least): • • • • • The description of the system The members of the emergency team (name, every par.) The key users (name, every par.) The places ! of the systems documentation (at least 2 media) nn Dr. Szenes 84 42 Business Continuity Planning and Disaster Recovery The IS BCP of the Individual Systems The table of contents for the systems business continuity plan contains (at least) -cont'd • The databases, their config., and their settings • The archives • The typical operations fallbacks • Manual / alternative operations • Software & hardware resource requirements minimum, presently available, maximum • Communications requirements • Recovery to normal state • nn Dr. Szenes 85 COBIT 3, 4 support of IS Audit and IT Security { 34 IS processes { 7 IS (evaluation) criteria { control objectives { control measures / procedures { Balanced Scorecard { Capability Maturity Model tailored to the 34 processes Dr. Szenes 86 43 Business Continuity Planning and Disaster Recovery COBIT 3, 4 support of IS Audit and IT Security the processes of delivery and support: { { { { { { { { { { { { { DS1 - Define and Manage Service Levels DS2 - Manage Third-party Services DS3 - Manage Performance and Capacity DS4 - Ensure Continuous Service DS5 - Ensure Systems Security DS6 - Identify and Allocate Costs DS7 - Educate and Train Users DS8 - Manage Service Desk and Incidents DS9 - Manage the Configuration DS10 - Manage Problems DS11 - Manage Data DS12 - Manage the Physical Environment DS13 - Manage Operations Dr. Szenes 87 DS4 - Ensure Continuous Service Control Objectives - forrás, többek között: COBIT 4.1 important: even if this is all about IT - all business-critical human and infrastructural assets should be taken care of DS4.1 IT Continuity Framework z Develop a framework for IT continuity to support enterprisewide business continuity management using a consistent process. The objective of the framework : z to assist in determining the required resilience of the infrastructure and z to drive the development of disaster recovery and IT contingency plans ./. Dr. Szenes 88 44 Business Continuity Planning and Disaster Recovery DS4 - Ensure Continuous Service Control Objectives - forrás , többek között : COBIT 4.1 DS4.1 IT Continuity Framework - cont'd The framework [and the plan] should address: z the organisational structure for continuity management, z on internal and external service providers { their management { and their customers z these: { roles, { tasks and { responsibilities ./. Dr. Szenes 89 DS4 - Ensure Continuous Service Control Objectives - forrás , többek között : COBIT 4.1 DS4.1 IT Continuity Framework The framework [and the plan] should address: - cont'd z the planning processes that create { the rules and { structures z in order to { document, { test and { execute the disaster recovery and IT contingency plans ./. Dr. Szenes 90 45 Business Continuity Planning and Disaster Recovery DS4 - Ensure Continuous Service Control Objectives - forrás , többek között : COBIT 4.1 DS4.1 IT Continuity Framework The framework [and the plan] should address: - cont'd z [based on risk assessment] { the identification of critical resources, { noting key dependencies, { [personal responsibilities] z the monitoring and z reporting of the availability of { critical resources, { alternative processing, z and [other] principles, [important info on] backup and recovery. Dr. Szenes 91 DS4 - Ensure Continuous Service Control Objectives - forrás , többek között : COBIT 4.1 DS4.2 IT Continuity Plans z Develop IT continuity plans based on the framework and designed to reduce the impact of a major disruption on { key business functions { and processes. z The plans should be based on risk understanding of potential business impacts -- see framework, DS 4.1, both IT BCP - BCP should be risk assessment-based ./. Dr. Szenes 92 46 Business Continuity Planning and Disaster Recovery DS4 - Ensure Continuous Service Control Objectives - forrás , többek között : COBIT 4.1 DS4.2 IT Continuity Plans - cont'd z The plan should address requirements for { resilience - flexibility!, { alternative processing and { recovery capability of all critical IT services. z The plan should contain { usage guidelines, { roles and responsibilities, { procedures, { communication processes, and { the testing approach - test plan, + procedure !. Dr. Szenes 93 DS4 - Ensure Continuous Service Control Objectives - forrás , többek között : COBIT 4.1 DS4.3 Critical IT Resources z Focus attention on items specified as most critical in the IT continuity plan { to build in resilience and { establish priorities in recovery situations. z Avoid the distraction of recovering less-critical items and z ensure response and recovery in line with prioritised business needs, z ensure that costs are kept at an acceptable level z ensure compliance { with regulatory and { contractual requirements. z Consider resilience, response and recovery requirements for different tiers, e.g., one to four hours, four to 24 hours, more than 24 hours and critical business operational periods. Dr. Szenes 94 47 Business Continuity Planning and Disaster Recovery DS4 - Ensure Continuous Service Control Objectives - forrás , többek között : COBIT 4.1 DS4.4 Maintenance of the IT Continuity Plan z Encourage IT management to define and execute { change control procedures to ensure that { the IT continuity plan is kept up to date { and continually reflects actual business requirements. z Communicate changes in { procedures and { responsibilities clearly and in timely manner. Dr. Szenes 95 DS4 - Ensure Continuous Service Control Objectives - forrás , többek között : COBIT 4.1 DS4.5 Testing of the IT Continuity Plan testing should be actually performed and documented together with the key business users & IT evaluated according to the results the plan should be updated 0 either forewarn the employees, or not z Test the IT continuity plan on a regular basis to ensure that { IT systems can be effectively recovered, { shortcomings are addressed { the plan remains relevant. ./. Dr. Szenes 96 48 Business Continuity Planning and Disaster Recovery DS4 - Ensure Continuous Service Control Objectives - forrás , többek között : COBIT 4.1 DS4.5 Testing of the IT Continuity Plan - cont'd z A successful test requires { careful preparation, { documentation, { reporting of test results and, according to the results, z implementation of an action plan z Consider the extent of testing: { recovery of single applications { integrated testing scenarios { end-to-end testing { integrated vendor testing. Dr. Szenes 97 DS4 - Ensure Continuous Service Control Objectives - forrás , többek között : COBIT 4.1 DS4.6 IT Continuity Plan Training z Provide all concerned parties with regular training sessions regarding the { procedures and { their roles and { responsibilities in case of an incident or disaster. z Verify and enhance training according to the results of the contingency tests. Dr. Szenes 98 49 Business Continuity Planning and Disaster Recovery DS4 - Ensure Continuous Service Control Objectives - forrás , többek között : COBIT 4.1 z DS4.7 Distribution of the IT Continuity Plan z Determine that a defined and z managed distribution strategy exists to ensure that plans are properly and securely distributed and z available to appropriately authorised interested parties when and where needed. z Attention should be paid to making the plans accessible under all disaster scenarios. Dr. Szenes 99 DS4 - Ensure Continuous Service Control Objectives - forrás , többek között : COBIT 4.1 DS4.8 IT Services Recovery and Resumption z Plan the actions to be taken for the period when IT is recovering and resuming services. This may include { activation of backup sites, { initiation of alternative processing, { customer and stakeholder communication, and { resumption procedures. z Ensure that the business understands { how to specufy for IT the recovery times they require { they have to help IT to buy the necessary technology investments to support business recovery and to provide for resumption needs. (thorough rewriting) Dr. Szenes 100 50 Business Continuity Planning and Disaster Recovery DS4 - Ensure Continuous Service Control Objectives - forrás , többek között : COBIT 4.1 DS4.9 Offsite Backup Storage z Store offsite { all critical backup media, { documentation and { other IT resources necessary for IT recovery and business continuity plans. ! develop and document processes to use all of these z business process owners and IT personnel should together determine { the content of backup storage { and its other parameters ./. Dr. Szenes 101 DS4 - Ensure Continuous Service Control Objectives - forrás , többek között : COBIT 4.1 DS4.9 Offsite Backup Storage - cont'd z Management of the offsite storage facility should comply to the { data classification policy and { the enterprise’s media storage practices. z IT management should ensure that offsite arrangements are periodically assessed, at least annually, for { content, { environmental protection and { security. z Ensure compatibility of hardware and software to restore archived data, z periodically test and refresh archived data. Dr. Szenes 102 51 Business Continuity Planning and Disaster Recovery DS4 - Ensure Continuous Service Control Objectives - forrás , többek között : COBIT 4.1 DS4.10 Post-resumption Review z Determine whether IT management has established procedures for { assessing the adequacy of the plan in regard to the successful resumption of the IT function after a disaster, and update the plan accordingly. Dr. Szenes 103 ISACA CRM Case Study (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) Case Study Scenario z Organization revising BCP and DRP for headquarters (750 employees) and 16 branches (each with 20–35 employees and mail and file / print server) z Current plans not updated in more than 8 years z Organization has grown by 300% z Staff connect via LAN to more than 60 applications, databases and print servers in the corporate data centre z Staff connect via a frame relay network to the branches z Traveling users connect over the Internet using VPN z Critical applications have RTO of 3–5 days ./. Dr. Szenes 104 52 Business Continuity Planning and Disaster Recovery ISACA CRM Case Study (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) Case Study Scenario - cont'd z All users in the headquarters and branches connect to the Internet through a firewall and proxy server located in the data center z Branch offices are located between 30 and 50 miles from one another, with none closer to the headquarters' facility than 25 miles z Backup media for the data center are stored at a third-party facility 35 miles away z Backups for servers located at the branch offices are stored at nearby branch offices using reciprocal agreements between offices ./. Dr. Szenes 105 ISACA CRM Case Study (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) Case Study Scenario - cont'd Current contract with third party hot site: • 3 year term, with equipment upgrades occurring at renewal time • 25 servers • Work area space with PCs for 100 employees • Separate agreement to ship 2 servers and 10 PCs to any branch declaring a disaster • Hot site provider has multiple sites in case the primary site is in use by another customer or rendered unavailable by the disaster Dr. Szenes 106 53 Business Continuity Planning and Disaster Recovery ISACA CRM Case Study - Q (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) Q1 On the basis of the above information, which of the following should the IS auditor recommend concerning the hot site? z A. Desktops at the hot site should be increased to 750. z B. An additional 35 servers should be added to the hot site contract. z C. All backup media should be stored at the hot site to shorten the RTO. z D. Desktop and server equipment requirements should be reviewed quarterly. Dr. Szenes 107 ISACA CRM Case Study (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) The correct answer to Q1 is D z As equipment needs in a rapidly growing business are subject to frequent change, quarterly reviews are necessary to ensure that the recovery capability keeps pace with the organization. z Since not all employee job functions are critical during a disaster, it is not necessary to contact the same number of desktops at a recovery facility as the number of employees. Similarly, not every server is critical to the continued operation of the business. z In both cases, only a subset will be required. z Since there is no assurance that the hot site will not already be occupied, it would not be advisable to store backup media at the facility. These facilities are generally not designed to provide extensive media storage, and frequent testing by other customers could compromise the security of the media. Dr. Szenes 108 54 Business Continuity Planning and Disaster Recovery ISACA CRM Case Study - Q (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) Q2 On the basis of the above information, which of the following should the IS auditor recommend concerning branch office recovery? z A. Add each of the branches to the existing hot site contract. z B. Ensure branches have sufficient capacity to back each other up. z C. Relocate all branch mail and file / print servers to the data center. z D. Add additional capacity to the hot site contract equal to the largest branch. Dr. Szenes 109 ISACA CRM Case Study (forrás: CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery) The correct answer to Q2 is B z The most cost-effective solution is to recommend that branches have sufficient capacity to accommodate critical personnel from another branch. z Since critical job functions would represent only perhaps 20 percent of the staff from the affected branch, accommodations for only four to seven critical staff members would be needed. z Adding each of the branches to the hot site contract would be far more expensive, while adding capacity to the hot site contract would not provide coverage as hot site contracts base their pricing on each location covered. z Finally, relocating branch servers to the data center could result in performance issues, and would not address the question of where to locate displaced employees. Dr. Szenes 110 55 Business Continuity Planning and Disaster Recovery References z CRM 20xx CISA Review Technical Information Manual editor: Information Systems Audit and Control Association Rolling Meadows, Illinois, USA, 20xx-1 z COBIT® 4.0 Control Objectives, Management Guidelines, Maturity Models Copyright © IT Governance Institute® , 2005 z COBIT® 4.1 Framework, Management Guidelines, Maturity Models Copyright © IT Governance Institute® , 2007 Dr. Szenes 111 References z Az Informatikai biztonság kézikönyve szerkesztő és lektor: Szenes Katalin Verlag Dashöfer, Budapest z K. Szenes: "IT GRC versus ? Enterprise GRC but: IT GRC is a Basis of Strategic Governance2 EuroCACS 2010 - Conference on Computer Audit, Control and Security Copyright 2010 ISACA, Rolling Meadows, Illinois, USA 23-25 March 2010, Budapest, Hungary Tutorial, Stream #1 IT Governance, #311 z CISA® Review Course transparents, ISACA 2010 Chapter 6: Business Continuity and Disaster Recovery z CISA® see ISACA.org Dr. Szenes 112 56 Business Continuity Planning and Disaster Recovery References z the predecessors of ISO 27001, ISO 27002 are: CRAMM, ISO/IEC 17799 z ISO 27001 International Standard ISO/IEC 27001 First edition 2005-10-15 Information technology - Security techniques - Information security management systems - Requirements Reference number: ISO/IEC 27001:2005 (E) Copyright © ISO/IEC 2005 z ISO 27002 International Standard ISO/IEC 27002 First edition 2005-06-15 Information technology — Security techniques — Code of practice for information security management Reference number: ISO/IEC 27002:2005(E) Copyright © ISO/IEC 2005 Dr. Szenes 113 57
© Copyright 2024