WEBVTT 00:00:00.940 --> 00:00:03.230 Hello, my name is Lyron. 00:00:03.240 --> 00:00:07.030 Thank you for joining me for the last portion of this 00:00:07.030 --> 00:00:10.650 Platform and Infrastructure Security CCSP course. We're 00:00:10.650 --> 00:00:14.280 going to now consider cloud‑based BCDR. 00:00:14.290 --> 00:00:18.920 First, we need a solid definition of what BCDR is. 00:00:19.110 --> 00:00:23.520 Then we'll move over to establishing a BCDR that's 00:00:23.530 --> 00:00:26.440 directly aligned with business requirements. 00:00:26.450 --> 00:00:31.110 Finally, we'll step through the processes that include creating, 00:00:31.120 --> 00:00:36.650 implementing, and then making sure that the BCDR actually works by testing it. 00:00:36.740 --> 00:00:41.610 First, understanding of the BCDR, we'll use the established 00:00:41.610 --> 00:00:50.280 definitions from 22301 as it focuses on the BC of BCDR. Now, the 00:00:50.280 --> 00:00:55.590 business continuity focuses on the delivery of value. 00:00:55.600 --> 00:01:01.790 Here, we're abstracting the underlying technology and we're actually focusing 00:01:01.790 --> 00:01:08.170 on why an organization would be consuming services from us. The DR component 00:01:08.180 --> 00:01:14.140 of BCDR, disaster recovery, has to do with the actual technology components, 00:01:14.150 --> 00:01:19.350 and here, we're also dealing with a predetermined time of disruption that's 00:01:19.350 --> 00:01:24.190 tolerable, just like there is a predetermined time tolerable for the delivery 00:01:24.200 --> 00:01:29.160 of services and value in the business continuity space. The things that 00:01:29.160 --> 00:01:33.380 support the business continuity would be the technology, so it's really good 00:01:33.380 --> 00:01:38.650 for us to think of DR as being a subset of business continuity. 00:01:38.660 --> 00:01:42.180 In fact, if you have a really good business continuity plan, 00:01:42.190 --> 00:01:47.010 you could suffer an interruption in your disaster recovery 00:01:47.020 --> 00:01:49.560 that allows your business to continue. 00:01:51.240 --> 00:01:54.070 We're going to look at the major elements, and then we'll 00:01:54.070 --> 00:01:57.160 look at some specific elements of BCDR. 00:01:57.170 --> 00:01:58.760 So at a major level, 00:01:58.770 --> 00:02:02.580 the first thing that you want to do is make sure that you have in 00:02:02.580 --> 00:02:05.710 line your organization's mission; the goals, 00:02:05.720 --> 00:02:06.790 the objectives, 00:02:06.800 --> 00:02:10.009 the values that will dictate the production of 00:02:10.009 --> 00:02:13.180 something that will be consumed as a value. 00:02:13.190 --> 00:02:17.060 Then you say that you want to protect that value from disruption, 00:02:17.060 --> 00:02:18.820 so that's what BCDR is about. 00:02:18.830 --> 00:02:21.960 The BCDR strategy will dictate the establishment of a 00:02:21.960 --> 00:02:24.420 business continuity management system. 00:02:24.430 --> 00:02:27.150 When we think of a business continuity management system, 00:02:27.240 --> 00:02:30.370 this is going to be a combination of activities, of roles, of 00:02:30.370 --> 00:02:33.980 processes; involving leadership, recovery teams, 00:02:33.980 --> 00:02:39.300 legal teams, regulatory requirements, risk analysis, so it's an ecosystem. 00:02:39.310 --> 00:02:43.140 Let's focus first on what does it mean from a leadership 00:02:43.150 --> 00:02:47.160 perspective. It's the leadership that is going to establish 00:02:47.160 --> 00:02:49.600 the policy and the objectives. 00:02:49.610 --> 00:02:53.580 Now, for a moment, think about what a good policy is. 00:02:53.590 --> 00:02:59.210 A good policy has to be brief, it has to be general in scope, 00:02:59.220 --> 00:03:01.340 it has to be overarching, 00:03:01.350 --> 00:03:05.480 it has to be legal, so these are the things that we're bringing into the 00:03:05.490 --> 00:03:09.220 actual continuity framework as supported by leadership. 00:03:09.230 --> 00:03:12.800 They are also going to ensure that there's a whole business continuity 00:03:12.800 --> 00:03:18.700 management system that gets established and some way of proving out that 00:03:18.700 --> 00:03:22.450 it actually accomplishes its goals as intended. 00:03:22.460 --> 00:03:27.280 If you do not have management supporting this and directing this, 00:03:27.290 --> 00:03:31.770 then the outcomes will actually be less predictable. 00:03:31.780 --> 00:03:35.580 Another thing that leadership should focus on is a center 00:03:35.580 --> 00:03:40.250 of excellence to continually improve the process of the 00:03:40.250 --> 00:03:41.650 business continuity framework. 00:03:43.740 --> 00:03:49.790 The framework has a BIA associated with it, a business impact analysis. 00:03:49.800 --> 00:03:52.590 Now, we're not going to steal the thunder from the 00:03:52.600 --> 00:03:54.570 next clip that we will go into, 00:03:54.580 --> 00:03:57.380 but at least the components of it we'll list right 00:03:57.380 --> 00:03:59.590 now. We'll go into detail later. 00:03:59.600 --> 00:04:04.560 An impact analysis is basically measuring what would the impact be 00:04:04.570 --> 00:04:07.680 if there was the discontinuance of a service. 00:04:07.690 --> 00:04:10.080 There are three ways of looking at this. 00:04:10.090 --> 00:04:13.710 There are three important elements associated with this. 00:04:13.720 --> 00:04:16.290 The maximum tolerable period of disruption, 00:04:16.300 --> 00:04:21.480 that is the most amount of time that you can be down and the business still 00:04:21.480 --> 00:04:26.140 survive; the recovery time objective is the time that it would take to bring 00:04:26.140 --> 00:04:31.640 the systems back up; and the recovery point objective is tied to the actual 00:04:31.640 --> 00:04:36.410 data point that is acceptable by the organization, so what is the toleration 00:04:36.410 --> 00:04:40.210 for loss of data. Again, we'll go into these more deeply in the next clip. 00:04:40.220 --> 00:04:45.640 The business continuity framework has to have a response to the law, 00:04:45.640 --> 00:04:50.630 so the law may dictate the amount of time that your organization can 00:04:50.630 --> 00:04:54.700 be without service. That may actually set your risk appetite. 00:04:54.700 --> 00:04:56.990 Regulatory requirements may do the same. 00:04:57.000 --> 00:05:01.710 You have to have some way of being able to process the changing of the law. 00:05:01.720 --> 00:05:06.950 So here we need to work very closely with general counsel. And it's a two way 00:05:06.950 --> 00:05:11.820 street. We're keeping them abreast of changes and they are also informing us 00:05:11.840 --> 00:05:19.740 of what changes are out there. The awareness component of business continuity 00:05:19.750 --> 00:05:25.600 says that all the organization should actually know that the organization has 00:05:25.610 --> 00:05:28.150 a business continuity plan, 00:05:28.160 --> 00:05:32.480 but all of them may not need training, even though they all need to be aware. 00:05:32.490 --> 00:05:35.140 So this is going to be a separation and delineation 00:05:35.140 --> 00:05:36.790 of roles and responsibilities, 00:05:36.800 --> 00:05:40.680 making certain that people are following the plan, and also 00:05:40.690 --> 00:05:43.630 what happens when the plan is not followed. How do you know 00:05:43.630 --> 00:05:44.950 the plan is not being followed? 00:05:44.960 --> 00:05:45.420 Well, 00:05:45.430 --> 00:05:48.770 you can initiate tests. This is what's going to 00:05:48.780 --> 00:05:51.680 improve the actual business function. 00:05:51.680 --> 00:05:54.870 It's kind of an amazing thing, where you're planning on 00:05:54.870 --> 00:05:57.290 failure, but because you're planning on that, 00:05:57.300 --> 00:06:00.420 you're actually doing things that help to promote 00:06:00.430 --> 00:06:02.850 resiliency within your organization. 00:06:03.240 --> 00:06:06.340 The business continuity framework also has a communication 00:06:06.340 --> 00:06:09.490 component to it, so this is who are you communicating with 00:06:09.500 --> 00:06:15.130 externally, so what downstream dependencies are there associated 00:06:15.130 --> 00:06:16.870 with your organization, in other words, 00:06:16.880 --> 00:06:20.330 organizations that are dependent on you, and what 00:06:20.340 --> 00:06:22.710 upstream dependencies may you have as well. 00:06:22.720 --> 00:06:26.380 You may also have peers and partners that you need to communicate with. 00:06:26.380 --> 00:06:31.520 You should be able to answer the six questions of existence when thinking 00:06:31.520 --> 00:06:36.810 about business continuity, and you're going to define your answers, to a 00:06:36.810 --> 00:06:44.060 large degree, on where your recovery locations will be. When it comes to 00:06:44.060 --> 00:06:48.670 the creation and the updating of the plan, we need to make sure that it's 00:06:48.680 --> 00:06:50.280 only on a need‑to‑know basis. 00:06:50.280 --> 00:06:51.190 Think about this, 00:06:51.200 --> 00:07:00.010 why would you keep the BCDR plans largely confidential? It is going to point 00:07:00.010 --> 00:07:04.670 out your greatest weakness by showing your greatest strength, right, for a 00:07:04.670 --> 00:07:09.550 continuance of business. If a malicious actor actually knows where your 00:07:09.550 --> 00:07:12.350 recovery is and then they induce failure, 00:07:12.360 --> 00:07:15.430 they could also pre‑attack that location, so 00:07:15.440 --> 00:07:18.930 confidentiality is going to be an imperative. 00:07:18.940 --> 00:07:23.040 Also, think about how you go about updating the plan. 00:07:23.050 --> 00:07:24.780 What kind of plan is it? 00:07:24.790 --> 00:07:26.590 Is it only in a digital format? 00:07:26.600 --> 00:07:28.440 Do you have written copies of it? 00:07:28.440 --> 00:07:31.300 And what is the deportment of those written copies? 00:07:32.140 --> 00:07:35.450 Also, inside of the business continuity framework is just a 00:07:35.450 --> 00:07:39.180 recognition that people should be at the center of it. 00:07:39.190 --> 00:07:43.310 How do you get to and from your recovery location? 00:07:43.320 --> 00:07:47.920 So you got to think about transportation. Is it in a car? Is it in a plane? 00:07:47.980 --> 00:07:51.260 What is the data that's going to be necessary? 00:07:51.270 --> 00:07:53.100 What does the infrastructure look like? 00:07:53.100 --> 00:07:58.270 What's the financial support and the agreement for pre‑allocation of cost? And 00:07:58.270 --> 00:08:03.470 then what that alternate location is. Is it a physical space? 00:08:03.480 --> 00:08:07.910 Is it a logical space, now that we have seen through the pandemic that a 00:08:07.910 --> 00:08:14.770 lot of what happens could be from individuals' homes. The response to 00:08:14.780 --> 00:08:19.300 business continuity says that you have to have experts that can actually 00:08:19.300 --> 00:08:24.140 make an assessment of the disruption. Those experts on the recovery team 00:08:24.150 --> 00:08:30.550 would then report to the executive emergency management team on their view 00:08:30.560 --> 00:08:32.490 of how bad things are. 00:08:32.500 --> 00:08:37.350 That would then allow the executive emergency management team to go 00:08:37.350 --> 00:08:42.190 through the process of an official activation of the plan. 00:08:42.200 --> 00:08:46.610 There should have been a pre‑establishment of prioritization that 00:08:46.610 --> 00:08:49.760 allows you to know what are the most critical elements that get 00:08:49.770 --> 00:08:54.430 recovered first, and you have to be able to monitor on an ongoing 00:08:54.430 --> 00:08:57.580 basis, are we meeting to the plan? 00:08:57.740 --> 00:09:05.700 Next, join me over in Creating the Business Established BCDR Strategy, and 00:09:05.700 --> 00:09:09.260 we'll look at more of the details from a cloud perspective.