Scribd
Upload
51 views

Modul 3 Contingency Planning Part 2

The document discusses various aspects of contingency planning and disaster recovery. It covers determining when to involve law enforcement, different types of disaster recovery plans, crisis management strategies, and options for alternate sites and off-site data storage. It also provides an overview of conducting a business impact analysis, developing threat scenarios, testing contingency plans, and continuously improving plans through an iterative process.

Uploaded by

Willy Apriliando Silalahi
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
51 views

Modul 3 Contingency Planning Part 2

The document discusses various aspects of contingency planning and disaster recovery. It covers determining when to involve law enforcement, different types of disaster recovery plans, crisis management strategies, and options for alternate sites and off-site data storage. It also provides an overview of conducting a business impact analysis, developing threat scenarios, testing contingency plans, and continuously improving plans through an iterative process.

Uploaded by

Willy Apriliando Silalahi
Copyright
© © All Rights Reserved
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 26

Contingency Planning

Law Enforcement Involvement

★ When incident violates civil or criminal law, it is


organization’s responsibility to notify proper authorities

★ Selecting appropriate law enforcement agency depends on the


type of crime committed: Federal, State, or Local

★ Involving law enforcement has both advantages and disadvantages:

★ Usually much better equipped at processing evidence,


obtaining statements from witnesses, and building legal cases

★ However, involvement can result in loss of control of chain of


events following an incident
Incident Response and Disaster Recovery
Disaster Recovery

★ Preparation for and recovery from a disaster, whether natural or


man made
★ In general, an incident is a disaster when:

★ organization is unable to contain or control the impact of

an incident
★ OR
★ level of damage or destruction from incident is so severe,

the organization is unable to quickly recover


★ Key role of DRP: defining how to reestablish operations at

location where organization is usually located


Disaster Classifications

★ A DRP can classify disasters in a number of ways

★ Most common method: separate natural disasters


from man-made disasters

★ Another way: by speed of development


★ Rapid onset disasters

★ Slow onset disasters


Planning for Disaster

★ Scenario development and impact analysis are used to


categorize the level of threat of each potential disaster

★ DRP must be tested regularly

★ Key points in the DRP:

★ Clear delegation of roles and responsibilities


★ Execution of alert roster and notification of key personnel

★ Clear establishment of priorities

★ Documentation of the disaster

★ Action steps to mitigate the impact

★ Alternative implementations for various systems components


Crisis Management

★ Set of focused steps taken during and after a disaster


that deal primarily with people involved

★ Crisis management team manages event:


★ Supporting personnel and their loved ones during crisis
★ Determining event's impact on normal
business operations
★ When necessary, making a disaster declaration

★ Keeping public informed about event

★ Communicating with outside parties

★ Two key tasks of crisis management team:


★ Verifying personnel status

★ Activating alert roster


Responding to the Disaster

★ Actual events often outstrip even best of plans

★ To be prepared, DRP should be flexible

★ If physical facilities are intact, begin


restoration there

★ If organization’s facilities are unusable,


take alternative actions

★ When disaster threatens organization at the


primary site, DRP becomes BCP
Business Continuity Planning (BCP)

★ Ensures critical business functions can continue in a disaster


★ Most properly managed by CEO of organization

★ Activated and executed concurrently with the DRP when needed

★ Reestablishes critical functions at alternate site (DRP focuses


on reestablishment at primary site)
★ Relies on identification of critical business functions and
the resources to support them
Exclusive Use Options

★ Hot Sites
★ Fully configured computer facility with all services

★ Warm Sites
★ Like hot site, but software applications not kept
fully prepared

★ Cold Sites
★ Only rudimentary services and facilities kept in readiness
Shared Use Options

Timeshares
Like an exclusive use site but leased

Service Bureaus
Agency that provides physical facilities

Mutual Agreements
Contract between two organizations to assist

Specialized alternatives:
Rolling mobile site
Externally stored resources
Off-Site Disaster Data Storage

To get any BCP site running quickly, organization must be able


to recover data

Options include:

1. Electronic vaulting: bulk batch-transfer of data to an off-


site facility
2. Remote Journaling: transfer of live transactions to an off-
site facility
3. Database shadowing: storage of duplicate online
transaction data
Disaster Recovery and
Business Continuity Planning
Contingency Plan Implementation Timeline
Putting a Contingency Plan Together

★ The CP team should include:


★ Champion

★ Project Manager

★ Team Members

★Business managers

★Information technology managers

★Information security managers


Major Tasks in Contingency Planning
Business Impact Analysis (BIA)

★ BIA
★ Provides information about systems/threats and
detailed scenarios for each potential attack
★ Not risk management focusing on identifying threats,
vulnerabilities, and attacks to determine controls
★ Assumes controls have been bypassed or are
ineffective and attack was successful

★ CP team conducts BIA in the following stages:


★ Threat attack identification

★ Business unit analysis

★ Attack success scenarios

★ Potential damage assessment

★ Subordinate plan classification


Threat/Attack
Identification and Prioritization

★ An organization that uses risk management


process will have identified and prioritized threats

★ These organizations update threat list and add one


additional piece of information -- the attack profile

★ Attack profile: detailed description of activities


that occur during an attack
Business Unit Analysis
Attack Success Scenario Development

★ Next create a series of scenarios depicting impact


of successful attack on each functional area

★ Attack profiles should include scenarios depicting


typical attack including:
★ Methodology

★ Indicators

★ broad consequences

★ More details are added including alternate


outcomes— best, worst, and most likely
Potential Damage Assessment

★ From detailed scenarios, the BIA planning team must


estimate the cost of the best, worst, and most likely
outcomes by preparing an attack scenario end case

★ This will allow identification of what must be done


to recover from each possible case
Subordinate Plan Classification

★ From existing plans, a related plan must be


developed or identified from among existing
plans already in place
★ Each attack scenario case is categorized as

disastrous or not
★ Attack cases that are disastrous find members

of the organization waiting out the attack and


planning to recover after it is over
Sample Disaster Recovery Plan

★ Name of agency
★ Date of completion or update of the plan and test date

★ Agency staff to be called in the event of a disaster

★ Emergency services to be called (if needed) in event

of a disaster
★ Locations of in-house emergency equipment and

supplies
★ Sources of off-site equipment and supplies

★ Salvage Priority List

★ Agency Disaster Recovery Procedures

★ Follow-up Assessment
Testing Contingency Plans

★ Once problems are identified during the testing


process, improvements can be made, and the resulting
plan can be relied on in times of need

★ There are five testing strategies that can be used to


test contingency plans:
★ Desk Check

★ Structured walkthrough

★ Simulation

★ Parallel testing

★ Full interruption
Testing Contingency Plans
Continuous Improvement

★ Iteration results in improvement

★ A formal implementation of this methodology is a process


known as continuous process improvement (CPI)

★ Each time plan is rehearsed, it should be improved

★ Constant evaluation and improvement leads to an


improved outcome

You might also like