Business Continuity Plans

00:02

Hey, guys, Welcome to another episode of the S S C P exam Prep Siri's I'm your host, Peter Sibylla.

00:09

This is going to be the third and last lesson off the fourth domain.

00:13

So far in the fourth domain, we've taken a look at incident handling, which is how an organization response to a security incident.

00:22

We've taken a look at forensic evidence, which is when the S S C P practitioner puts together all the little pieces of information that were based on the security event to discover and to figure out how the incident happened to begin with.

00:38

And finally, in this lesson will be looking at Business continuity plans, which are plans which can be executed to restore business operations within a pre differ predefined times after a disaster. And we'll also be looking at Disaster recovery plans, which focuses on the restoration of I t functions

00:58

after a disaster.

00:59

Let's get started.

01:03

Business Continuity Plan, also known as a B C P, focuses on the continuity and recovery of business functions during and after a disaster. So in the case of a disaster or a business gets rocketed for an extended period of time, a B C teams

01:22

help smooth the transition to coming back to normal system day to day operations.

01:27

It's really a pro active development of a plan to restore business operations. Now

01:34

BCPs are very very, uh, they're done. They're time consuming and money consuming, whether they're very significant organizational commitment to turn in terms of people and resources. But they are definitely very necessary in case the organization

01:53

or system does experience

01:56

some type of disaster or downtime.

02:00

A couple of key terms associated with the business continuity plan is the business impact analysis, also known as a B I. A. This is an exercise that determines the impact and losing the support of any resource to an organization.

02:15

So basically, it determines how much will a business suffer. If a particular resource is not available right now, how much? How much impact will a business take? If this resource is not available,

02:32

maximum tolerable downtime, NTD or Mt. P. O. D. Which is the maximum tolerable period of disruption.

02:40

This is the maximum time a business function could be unavailable before the organization is harm to a degree that puts the survivability of the organization at risk. So what it means is what is the longest time a resource to be unavailable before the organization is about to fail.

03:01

Recovery time objective. Artie. Oh, this is the earliest time period and a service level within a business process, which must be restored after a disaster to avoid unacceptable consequences. What is the earliest time period that a resource can come back from being different?

03:21

Recovery point objective. Our P O. Is a measurement of the point prior to an outage to which the data are to be restored. So if a system goes down and it loses its data, recovered point objective is usually

03:37

the last time there was assistant backup for the last time he safe was done.

03:42

So when the system gets backed up could be backed up to that point

03:46

Business continuity plan. This establishes the Business Continuity program and the directly related policy right. So when building a B, C P u want to establish the key participants, you want to identify who were the major players in this plan,

04:03

and what are the major resource is

04:08

after that, you want to conduct a business impact analysis which we have looked at, which really figures out one of the most mission critical resource is. And if the organization or system does not have access to these resource is

04:24

how How bad will this damage the organization or system?

04:29

We're gonna want to determine all the potential impacts If supporting resource is were unavailable Now, these impacts can be tangible or not tangible,

04:40

tangible results, air or things that can be measured that have a direct cost

04:46

associated with the organization. Examples include processing time, loss of money, decreased employee productivity, things, things like that.

04:56

Intangible results are results that aren't easily measured, but they definitely have a negative impact on the organization. These air things such as loss of customer confidence, bad employee morale and negative public relations.

05:12

Disaster Recovery Plan D R P. A document that details the steps that should be performed to restore critical i t systems in the event of a disaster. So a business continuity plan focuses on the entire business or system as a whole

05:30

and focuses on the mission

05:32

critical. What needs to happen to bring the system's back in to smooth out the process off the business recovering from a disaster while the disaster recovery plan

05:45

more or less does the same thing but focuses on Lee on the I T systems.

05:49

So considerations right? There's different types of disasters. There's intentional acts of sabotage or through insider threats of physical threats, any type of hacking going on and also any other potential threats.

06:04

Assets that are looked at an a D R P R data information systems, network devices, facilities, personnel anything related to information technology.

06:18

So sometimes when if they, you know, business or organization goes down in case of a disaster, the business must be removed. The organization must move to an alternative spot. So there are several different types off available spots in which an organization can choose from.

06:36

The first is calling a cold site.

06:39

This is really just a shell of a building with power raised floors, and that's about it. Just think of a warehouse with electricity and that's it.

06:48

There's no there's no frills. It's very empty.

06:51

There's there's nothing there. This is also the cheapest of all of the options, but it takes the longest to get ready in order for the business to power up. There is not a sight place called the warm site, which does not have computers, but it does have some things for I, such as this drives

07:11

controllers tape drives.

07:12

It might be a spot where their backup media might be available, or might be just kind of like an empty office building with awesome hardware equipment.

07:21

Then there's the hot site, which is a fully configured office base with hardware, software and all of the environmental needs. This is the most expensive off the three sites in order to have ready, but is also the quickest way to get an organization back up and running.

07:40

They can simply switch to the other new hot site

07:43

and everything goes impossible. Everything everything is

07:46

immediately back online.

07:48

Multiple processing sites on these support 100% availability data is processed simultaneously in both spots. Those really At this point, if you have a multiple processing sites, there is no difference between one site or the young. They do the exact same thing.

08:09

Also a mobile site,

08:11

which is a site that can be deployed to any location based on the circumstances off disaster. This is usually a thing. I was like a trailer or something that could be pulled from place to place

08:26

plan testing. Obviously, if you're going to do anything you must tested to make sure it works as it's supposed to, especially B. C. P's and D R piece. These are huge, huge financial and time commitment to organizations on dhe. They're incredibly important,

08:45

so obviously they need to be tested to make sure they're accurate.

08:48

There's a bunch of different ways you could test this. There's the checklist. Test is when each participant reviews their section of the plan to know what they do. There is the structure and walk through tests where usually like the department head or the person in charge of a particular area on, they all get together

09:05

and they review the plan. Together

09:09

there is a simulation test where a disaster is simulated.

09:13

There is a parallel test where there's a performing, processing, an alternative site, and there's the full interruption test, where regular operations air stopped at the original site and everything is physically moved and started back up again at the new site.

09:33

Backups and restoration. Obviously, if something goes off line or something crashes, you definitely want to bring back any data or system configurations. You want to bring them and restore them so the business organization can continue to operate as normal. There are several different types of

09:54

backups

09:54

there is. The full backup is where the entire system is copping to backup media.

10:01

There is a differential backup, which records all the differences in data since the most recent

10:07

full backup.

10:07

And then there is the incremental backup, which records different changes that are made to the system on a daily basis. It really comes down to what kind of organization that what were your organization does, which determines what kind of backups you might have? But normally most organizations have a full back up,

10:26

and then either

10:28

a differential backup or an incremental backup.

10:33

There's also offsite storage. Backup should obviously be stored in an off site in a secure location. If you're going to have your backups on a computer, please make sure that computer is off line. Please make sure that they are in an isolated network with no Internet access, so no one

10:52

can actually get the backups

10:54

off of the computer unless they're physically there.

10:58

Electronic vaulting. This allows backups across the Internet to an off site location. This is not bad in itself, because at that point you don't have to physically transport the backups to the off site location. But once the backups are at the off site location, you definitely want to make sure they have no access to the Internet.

11:16

And there's remote journaling where journals and transaction logs are transmitted electronically. It's very similar to electronic vaulting

11:26

availability.

11:26

You definitely wanna have all of your systems available as much as possible. There's a couple different ways to implement availability. The 1st 1 is clustering right. This is a method of configuring multiple computers, so they operate as a single system. So if you think of

11:45

three computers and they are all operating as one, so if one goes down and the other two can continue to function

11:50

and you won't even notice the difference,

11:54

you have high availability clustering, which is clustering method that uses multiple systems to reduce the risk associated with a single point of failure.

12:03

High availability. Clustering is the diagram on the top, so you have your server A and your server be surfer is the act of one B is the passive one. So if something happens to server A and it goes down server be picks right up where Server A left off and continues to process

12:22

until server A

12:24

eyes fixed. And at that point server be gives up its responsibilities. Back to server A and then server be goes back to being a passive server again.

12:33

There's also load bouncing, clustering. This is where all the clusters are active, So if the system fails, all the other ones take its place. This is ah, where what processes? Responsibilities are distributed evenly among all of the active cluster news. So if

12:52

something comes in to say there was like four responsibilities,

12:56

First Responsibility gets assigned to the first ***. The second parental responsibility gets re signed, assigned to the second ***. The third goes to the third ***, and then the fourth responsibility goes back up to the first ***. And then the process repeats

13:15

redundant array of independent discs, also known as raid. This is very good for having backup data and being accessed, being able to access it when you need it.

13:26

There are three main types.

13:28

The three main types of raid there is mirroring, which is when data is written to separate hard drives. At the same time, there is a parody, which is the technique of determining whether data has been lost or written. And then they're striping, which is a data element,

13:46

which is broken down in the motel pieces. And each piece is

13:50

Bren across different hard drives.

13:52

Let's take a look at Raid and a little bit more detail. There's a bunch of different kind. So first we have raid zero.

13:58

Raid zero simply does striping where Block one goes on. This born blocked two goes on. This, too, and so on. All the data is broken up into little chunks on. Then the chunks are alternated. Between the two discs.

14:13

He half raid one, which focuses on Lee on Miriam.

14:16

These are identical copies that data just store on two separate drives. So whatever is in this one isn't just to

14:24

raid tomb, and three. These are not used in practice, but it's good to be familiar with them, So raid to use is striping. Data is broken up into chunks on the chunks are written across the disks. A little pieces written to each disc, but it's done at the bit level, so this is

14:45

good in the sense

14:46

that there's good data redundancy, but since it works at the bit level, it's way thio time and power consuming.

14:54

Raid three is the exact same thing, but it uses a parodist which helps you turn while not data gets over written. And it's also used at the blight well, which again? The peace the boy is just. It's just useful

15:11

raid for

15:11

wherefore implements striping again. But this time it's at the block level, and it also uses a dedicated parody disc to make sure that there is no data being overwritten. This also is not used in practice, and then Rafe, I've read five is very popular. This uses block level striping with

15:31

parodies

15:33

that is that are distributed across multiple disks.

15:37

You can also combine the ray levels so they can do different things and have the best of the best of both worlds. So if you can this example, if you combine rate zero and raid one, you can have mere discs which are then striped across two disks. So in the diagram

15:58

brain,

15:58

the raid zero, which is mirrored disks, right. So this zero and this one of the same and then just two in just three of the same. And then from there you have the data broken up in the little blocks, which are spread out between the two discs.

16:15

In today's lecture, we discussed business continuity plans, disaster recovery plans

16:22

and availability and dungeon see

16:25

quiz time.

16:26

Having representatives from each business unit gathered together to review is considered to be what type of plant testing is it? A checklist test.

16:34

Be structured, walk through tests.

16:37

See simulation test or deep parallel test.

16:45

If you said be structured, walk through tests than you are correct. Remember the structure of all through test this when each of the department heads or people in charge of an area come together and they review the type of plan together.