getting started with business continuity
DESCRIPTION
An introduction to business continuity management with a focus on smaller businesses and resources to explore the subject in more depth.TRANSCRIPT
Getting Started with Business Continuity
Stephen Cobb, CISSPSecurity Researcher, ESET NA
What’s on the agenda?
• How can your organization survive disruptive incidents?– Everything from natural
disasters to hacking attacks• You need a business
continuity plan
What’s the problem?
• Power goes out• Internet connection
goes down• Your office floods• Toxic gas cloud
forces evacuation• Hackers get into your web
server• Hopefully not all at once
Business Continuity Management
• Your organization needs the ability:– “to continue to deliver its
products and services at acceptable predefined levels after disruptive incidents have occurred”
• This is BCM, as defined by ISO 22301
Not all organizations survive
• Some go out of business IF they are hit with a disaster for which they have not adequately prepared
• Often cited statistic: 1 in 4 fail• Fortunately, the path to proper
disaster preparedness is well-documented (see Attachments)
Question #1Does your organization have a business continuity plan?
Yes No I’m not sure I don’t work for an
organization
What sort of disruptive incidents?• Fire• Flood• Earthquake• Tsunami• Tornado• Hurricane• Blizzard• Volcanic eruption creating a giant
ash cloud that grounds aircraft
Incidents and accidents
• Technical– Unscheduled IT outage– Communications outage–Malware infection
• Human– Scandal, fraud and terrorism– Transportation accidents– Social media storm
What’s the biggest threat?
Security incident
Utility supply interuption
Adverse weather
Data breach
Cyber attack
Unplanned ITC outages
0% 10% 20% 30% 40% 50% 60% 70% 80% 90%
53%
56%
57%
73%
73%
77%
Business Continuity Institute’s Horizon Scan, 2014, based on interviews with 600+ BCM professionals around the world
What is BCM Step 1?
• Identify and rank threats– List potentially disruptive incidents
most likely to affect your business• Don’t use someone else’s list– Threats vary according to location
Practical strategy
• Brainstorm with representatives from all departments
• Generate company and location specific list of disaster scenarios– Ranked by probability of
occurrence and potential for negative impact
– Consider regional variations, some threats location-specific
BCM Step 2: Business Impact Analysis
• Which business functions are most critical to its survival?
• Requires knowledge, or discovery, of all parts of the organization
• Multi-department team effort• There are templates for this
Practical technique: BIA
• Detail the functions, processes, personnel, places and systems that are critical to the functioning of your organization
• BCM project leader interviews employees in each department
• Resulting table lists functions and key person(s) and alternate(s)
Practical technique: BIA
• Determine number of Survival Days for each function
• How long before lack of that function causes serious impact?
• Rank the impact of that function not being available
The Miora technique
• Use an Impact scale of 1 to 4• Where 1 = critical operational
impact or fiscal loss, and 4 = no short tern impacts
• Multiply Impact x Survival Days• Reveals criticality of functions• Most critical? Functions where
Impact = 1 and Survival Days = 1
Question #2When was the last time your organization tested its disaster/recovery/continuity plan?
2014 2013 Before 2013 We don’t have a plan I don’t work for an
organization
BCM Step 3
• The Response and Recovery Plan• Catalog key data about the assets
required to restore critical functions– IT systems, facilities, personnel,
suppliers, partners, customers, law enforcement, emergency services
• Plan must cover HR, IT, PR, asset management, accounting, facilities
Practical technique: The Plan
• Record asset serial numbers, licensing agreements, leases, warranties, contact details
• Determine “who to call” for each category of incident
• Create a calling tree so the right calls get made, in the right order
Practical technique: IT
• Document arrangements you have in place for transitioning to temp locations and IT facilities
• Document backups and archives• Consider using
cloud-based IT for some functions
Practical technique: PR controls
• You need a “who can say what” list to control interaction with the media during an incident
• Train all employees on this• Consider a “CEO-only” rule• Don’t overlook social media
Practical technique: People
• Document an “all-hands” notification process
• Design and document customer advisory criteria and procedures
Practical technique: Steps
• Steps to recover key operations should be laid out in a sequence that accounts for functional inter-dependencies.
• Get plan approved• Train managers and their reports
on the plan details relevant to each location and department
BCM Step 4: Test and Refine
• Experts recommend testing your plan at least once a year
• Use exercises, walk-throughs, simulations
• With testing you get the most out of your investment in creating the plan
Practical strategy
• Testing enables you to find gaps and account for changes in the business and threats over time
• Tests can also impress management
Yes, BCM is hard work
• But what’s the alternative?• Ignore at your peril• Too daunting to undertake on a
company-wide basis?• Begin with a few departments, or
one office if you have several• Everything you learn in the
process can then be applied more broadly
There is some help for SMBs
• OFB-EZ: Disaster Protection and Recovery Planning Toolkit for the Small to Mid-Sized Business– disastersafety.org/open-for-
business• Very helpful, and free
What threats are on the rise?
• Emerging trends or uncertainties “on the radar” in terms of business continuity implications:–Malicious Internet attacks (73%)– Influence of social media (63%)– New regulations and increased
regulatory scrutiny (55%)• 2014 BCI Horizon Scan
Also rising (45-50%)
• High adoption of Internet-dependent services
• Emergence of a global pandemic
• Increasing supply chain complexity
Areas of rising concern
BCM Resources
• We Live Security article• Resource list with links• eset.com/bcm• Attachments• Consider:– BCI membership
• Subscribe:– Disaster Recovery Journal
Thank you!
• [email protected]• www.eset.com• WeLiveSecurity.com• eset.com/bcm
Polling Question: I would like access to the following:
Request access to the Passmark Competitive Analysis Report
Request a custom business trial Subscribe to ESET’s global threat
report All of the above None of the above
Q&A Discussion