Vi - Business Continuity And Disaster Recorery

Front 1

How can risk analysis be utilized during a BCP/DRP?

Back 1

Can lead to immediate mitigation steps. If done before, future disasters may have less of an impact if risk analysis has led to proper preparation.

Front 2

Difference between BCP and DRP

Back 2

Business Continuity Plan is focused on making business run before, during and after disaster. More long term planning related.

Disaster Recovery Plan is more short term and is focused on primarily technical means to get through a disaster.

Front 3

How are BCP and DRP related?

Back 3

DRP is part of the umbrella BCP. BCP focuses on business, and DRP focuses on systems. You have to have many of the systems to ensure that business will go on.

Front 4

Three categories of Disaster (and a sometimes 4th)

Back 4

1) Natural - Earthquake, flood, etc.
2) Human
a) Intentional - Deliberate, motivated acts by a human
b) Unintentional - Through laziness or lack of knowledge, a human can unintentionally cause harm. Errors and Omissions falls into this grouping.
3) Environmental - Typically refers to disruptions to the data center (black out, brown out, spike, etc).
4) Technical Threat - Could be lumped in with human, but would include malware, DoS, etc.

Front 5

What is the most common threat faced by an organization

Back 5

Errors and Omissions

Front 6

Most common occurring disaster event for a data center.

Back 6

Electrical Problems.

Front 7

Aurora Attacks

Back 7

2010 - Chinese based attack aimed at Google and other large corporations.

Front 8

Personnel issues and disaster

Back 8

There can be personnel shortages during a disaster which must be kept in mind. This could be not only with major disasters but also pandemic and disease, strikes, and one key member of the team becoming unavailable.

Front 9

Communications Failure

Back 9

AT&T's cable woes in Plainview

Front 10

What are the 5 basic steps involved in Disaster Recovery?

Back 10

1) Respond
2) Activate the team
3) Ongoing tactical communication
4) Further assessment of the damage
5) Recovery of critical assets

Front 11

What trumps business in Disaster Recovery?

Back 11

People

Front 12

Respond Phase of DR

Back 12

An initial assessment of damage (more full assessment will be done later on).

Front 13

Activate Team Phase of DR

Back 13

Contact the team any way possible

Front 14

Communication Phase of DR

Back 14

Set-up hand-offs and status updates between teams, and determine a plan for communication to the organization and those outside the organization as needed.

Front 15

Assessment Phase of DR

Back 15

This will include Maximum Tolerable Downtime (MTD), and the details of hampered systems, as well as safety aspects.

Front 16

Reconstitution Phase of DR

Back 16

Determining which critical systems can be brought back up an the current or an alternate site. Should not cause further security issues by moving to any alternate site.

Front 17

What are the 8 High Level Steps for developing a BCP/DRP according to NIST?

Back 17

1) Project Initiation
2) Scope the Project
3) Business Impact Analysis
4) Identify Preventative Controls
5) Recovery Strategy
6) Plan Design and Development
7) Implementation, Training and Testing
8) BCP/DRP Maintenance

Front 18

What are the 7 milestones for scoping the project (with regards to development of a BCP/DRP)?

Back 18

1) Contingency planning policy statement.
2) Conduct the business impact analysis (BIA) - This will help to determine the critical systems.
3) Identify preventative controls.
4) Develop recovery strategies
5) Develop an IT contingency plan
6) Plan testing, training and exercises
7) Plan maintenance (routine upkeep of the document).

Front 19

Management Support (related to BCP/DRP)

Back 19

You must have upper level management support on your BCP/DRP so that you can ensure that funds and resources will be available when needed.

Front 20

CPPT

Back 20

Continuity Planning Project Team

Front 21

Three areas of support required from Executive Management for BCP/DRM

Back 21

1) Support for initiating the plan.
2) Final approval of the plan
3) Must show due care and due diligence and show that they are holding to applicable laws/regulations

Front 22

What is BIA, and what is it's primary goal?

Back 22

Business Impact Analysis

How will a disruption in systems affect the organization's business.

Primary goal is to determine the Maximum Tolerable Downtime (MTD)

Front 23

What are the 2 processes in the BIA?

Back 23

1) ID of critical assets
2) Comprehensive risk assessment

Front 24

What are the 2 metrics involved in MTD?

Back 24

1) Recovery Time Objective (RTO)
2) Work Recovery Time (WRT)

Front 25

What are 3 other acceptable names for Maximum Tolerable Downtime?

Back 25

1) Maximum Allowable Downtime (MAD)
2) Maximum Tolerable Outage (MTO)
3) Maximum Acceptable Outage (MAO)

Front 26

Recovery Point Objective (RPO)

Back 26

The amount of data loss or system inaccessibility that a business can stand.

Front 27

What are RTO and WRT, and how are they related?

Back 27

Recovery Time Objective and Work Recovery Time.

RTO is the time required to get a system back up, and WRT is the time required to get the system reconfigured after bringing it back up. MTD=RTO+WRT

Front 28

MTBF

Back 28

Mean Time Between Failures

How often is a piece of equipment expected to fail. Often provided by the vendor.

Front 29

MTTR

Back 29

Mean Time to Repair

How long will it take to repair a downed device?

Front 30

MOR

Back 30

Minimum Operating Requirements

This is necessary to know what systems will need for power, etc. to come back up in a disaster.

Front 31

Why is supply chain management necessary in BCP/DRP

Back 31

You must know how you are going to be able to replace devices in the event of an emergency.

Front 32

What is the difference between hot and redundant sites?

Back 32

A hot site can be up in a very short amount of time, where as a redundant site is always ready and a user would not even notice an issue.

Front 33

Reciprocal Agreement

Back 33

Also referred to as Mutual Aid Agreements (MAA) - One site agrees with another to back each other up in case of emergency.

Front 34

Mobile Site

Back 34

Datacenters on wheels. Contain racks, HVAC, fire suppression and physical security.

Front 35

Subscription Services

Back 35

A 3rd party who provides BCP/DRP for companies at a fee. This is an example of transferring risk.

Front 36

Name 7 plans under the umbrella of BCP.

Back 36

1) DRP
2) Continuity of Operations Plan (COOP)
3) Business Resumption/Recovery Plan (BRP)
4) Continuity of Support Plan
5) Cyber Incident Response Plan
6) Occupant Emergency Plan (OEP)
7) Crisis Management Plan (CMP)

Front 37

Continuity of Operations Plan (COOP)

Back 37

Procedures necessary to maintain operations during a disaster.

Front 38

Business Recovery Plan (BRP)

Back 38

aka... Business Resumption Plan (BRP)

This details steps to get things back to normal. Picks up after COOP is complete.

Front 39

Continuity of Support Plan

Back 39

Focuses strictly on IT systems and applications over the business aspects.

Front 40

Cyber Incident Response Plan

Back 40

This is a plan specific to cyber attacks and events.

Front 41

Occupant Emergency Plan (OEP)

Back 41

This is focused on the occupant safety of a datacenter in the event of a disaster. Should include drills, etc. to aid in preparation.

Front 42

Three Steps to Crisis Management Plan (CMP)

Back 42

A plan to bring the managers of the organization together during an emergency.

Includes Crisis Communications Plan, Emergency Operations Center and Vital Records.

Front 43

Automated Call Tree

Back 43

May involve voice mails, emails, texts etc. Can even have a link to automatically join the conference bridge. Typically supported by a 3rd party.

Front 44

Vital Records

Back 44

Should include contact information, policies and procedures, licensing information, etc.

Front 45

Executive Succession Planning

Back 45

Make sure that there is a plan for filling vacancies if needed during disaster to ensure that decision making and the ability to function will not be hampered.

Front 46

Who is ultimately responsible for the BCP/DRP approval?

Back 46

Senior Management

Front 47

What is the difference between incremental and differential backups?

Back 47

Incremental backups look at what has changed since the last full OR incremental backup. Differential backups look at what data has been changed since the last full backup. Differential backups take longer than incremental, but result in easier recovery as well.

Front 48

Electronic Vaulting

Back 48

Acts as a batch type backup that is done daily or even hourly. Sends the data offsite via internet.

Front 49

Remote Journaling

Back 49

A log of all database transactions. Can be combined with a database checkpoint (a snapshot of the database at a given point in time) to recover from failure.

Front 50

Database Shadowing

Back 50

A secondary database (usually offsite) that is updated concurrently with the primary database.

Front 51

High Availability (HA) Cluster... What is it, and what are the 2 typical deployment approaches?

Back 51

Redundancy in systems to allow return online in seconds rather than hours.
1) Active - Active Cluster: Both systems are active and processing at all times. If one goes down, the other takes over.
2) Active - Passive Cluster: Also referred to as a hot spare, standby or failover cluster. It is up and ready to begin processing at a moments notice.

Front 52

Software Escrow

Back 52

When the writers of software give the code to a neutral 3rd party in the event that they go out of business or are otherwise incapacitated.

Front 53

What is one of the more common mistakes in BCP/DRP?

Back 53

Lack of training and testing of DRP.

Front 54

6 types of DRP Testing and their meaning

Back 54

1) DRP Review: Reviewing it at least yearly to ensure it's continued accuracy.
2) Checklist: Making a checklist and ensuring their availability for completing Disaster Recovery.
3) Structured Walkthrough/Tabletop: Walk through the steps on paper to ensure that you caught everything.
4) Simulation Test/Walkthrough Drill: Actually go through the steps instead of just discussing them.
5) Parallel Processing: Actually recovering and restoring a backup and the comparing it with the LIVE data to ensure it's accuracy.
6) Partial and Complete Business Interruption: Risky. Should be done where there is another synced system ready to go.

Front 55

Name 3 parts of training that are often overlooked.

Back 55

1) Basic first aid and CPR
2) Starting Emergency Power
3) Call Tree Training/Test

Front 56

Change Mangement and the BCP/DRP

Back 56

Changes must be reviewed in relation to the BCP/DRP. Make updates as needed.

Front 57

What are some common BCP/DRP Mistakes (there were 10 of them listed, but at least know 6)

Back 57

1) Lack of Management support
2) Lack of business unit involvement
3) Lack of prioritization among critical staff
4) Improper (often narrow) scope
5) Inadequate telecommunications management
6) Inadequate supply chain management
7) Incomplete or inadequate crisis management plan
8) Lack of testing
9) Lack of training and awareness
10) Failure to keep BCP/DRP up to date.

Front 58

What are 4 specific frameworks for mapping BCP/DRP?

Back 58

1) NIST SP 800-34
2) ISO/IEC-27031
3) BS-25999
4) BCI

Front 59

NIST SP 800-34

Back 59

Contingency Planning Guide for Information Technology Systems

Front 60

ISO/IEC-27031

Back 60

Information technology - Security Techniques - Guidelines for ICT Readiness for Business Continuity.

It is in draft form and cannot be used yet as your primary resource. It focuses on BCP ONLY!!!

Front 61

ICT

Back 61

Information and Communication Technology (term used by ISO/IEC 27031)

Front 62

ISMS

Back 62

Information Security Management System (term used by ISO/IEC 27031)

Front 63

BS-25999

Back 63

A British Standards Institution (BSI) product.

Has 2 Parts...
1) Code of Practice - Business Continuity best practice recommendations.
2) the Specification - Provides the requirements for a Business Continuity Management System (BCMS).

Front 64

BCI... What is it, and what are it's 6 Good Practice Guideline (GPG)?

Back 64

Business Continuity Institute

Has 6 steps to the Good Practice Guidelines (GPG)...
1) Introductory information with BCM Policy and Program Management
2) Understanding the organization
3) Determining BCM Strategy
4) Developing and Implementing BCM Response
5) Exercising, Maintaining and Reviewing BCM arrangements
6) Embedding BCM in the Organization's culture.