Hello, my name is Lyron.
Thank you for joining me for the last portion of this
Platform and Infrastructure Security CCSP course. We're
going to now consider cloud‑based BCDR.
First, we need a solid definition of what BCDR is.
Then we'll move over to establishing a BCDR that's
directly aligned with business requirements.
Finally, we'll step through the processes that include creating,
implementing, and then making sure that the BCDR actually works by testing it.
First, understanding of the BCDR, we'll use the established
definitions from 22301 as it focuses on the BC of BCDR. Now, the
business continuity focuses on the delivery of value.
Here, we're abstracting the underlying technology and we're actually focusing
on why an organization would be consuming services from us. The DR component
of BCDR, disaster recovery, has to do with the actual technology components,
and here, we're also dealing with a predetermined time of disruption that's
tolerable, just like there is a predetermined time tolerable for the delivery
of services and value in the business continuity space. The things that
support the business continuity would be the technology, so it's really good
for us to think of DR as being a subset of business continuity.
In fact, if you have a really good business continuity plan,
you could suffer an interruption in your disaster recovery
that allows your business to continue.
We're going to look at the major elements, and then we'll
look at some specific elements of BCDR.
So at a major level,
the first thing that you want to do is make sure that you have in
line your organization's mission; the goals,
the objectives,
the values that will dictate the production of
something that will be consumed as a value.
Then you say that you want to protect that value from disruption,
so that's what BCDR is about.
The BCDR strategy will dictate the establishment of a
business continuity management system.
When we think of a business continuity management system,
this is going to be a combination of activities, of roles, of
processes; involving leadership, recovery teams,
legal teams, regulatory requirements, risk analysis, so it's an ecosystem.
Let's focus first on what does it mean from a leadership
perspective. It's the leadership that is going to establish
the policy and the objectives.
Now, for a moment, think about what a good policy is.
A good policy has to be brief, it has to be general in scope,
it has to be overarching,
it has to be legal, so these are the things that we're bringing into the
actual continuity framework as supported by leadership.
They are also going to ensure that there's a whole business continuity
management system that gets established and some way of proving out that
it actually accomplishes its goals as intended.
If you do not have management supporting this and directing this,
then the outcomes will actually be less predictable.
Another thing that leadership should focus on is a center
of excellence to continually improve the process of the
business continuity framework.
The framework has a BIA associated with it, a business impact analysis.
Now, we're not going to steal the thunder from the
next clip that we will go into,
but at least the components of it we'll list right
now. We'll go into detail later.
An impact analysis is basically measuring what would the impact be
if there was the discontinuance of a service.
There are three ways of looking at this.
There are three important elements associated with this.
The maximum tolerable period of disruption,
that is the most amount of time that you can be down and the business still
survive; the recovery time objective is the time that it would take to bring
the systems back up; and the recovery point objective is tied to the actual
data point that is acceptable by the organization, so what is the toleration
for loss of data. Again, we'll go into these more deeply in the next clip.
The business continuity framework has to have a response to the law,
so the law may dictate the amount of time that your organization can
be without service. That may actually set your risk appetite.
Regulatory requirements may do the same.
You have to have some way of being able to process the changing of the law.
So here we need to work very closely with general counsel. And it's a two way
street. We're keeping them abreast of changes and they are also informing us
of what changes are out there. The awareness component of business continuity
says that all the organization should actually know that the organization has
a business continuity plan,
but all of them may not need training, even though they all need to be aware.
So this is going to be a separation and delineation
of roles and responsibilities,
making certain that people are following the plan, and also
what happens when the plan is not followed. How do you know
the plan is not being followed?
Well,
you can initiate tests. This is what's going to
improve the actual business function.
It's kind of an amazing thing, where you're planning on
failure, but because you're planning on that,
you're actually doing things that help to promote
resiliency within your organization.
The business continuity framework also has a communication
component to it, so this is who are you communicating with
externally, so what downstream dependencies are there associated
with your organization, in other words,
organizations that are dependent on you, and what
upstream dependencies may you have as well.
You may also have peers and partners that you need to communicate with.
You should be able to answer the six questions of existence when thinking
about business continuity, and you're going to define your answers, to a
large degree, on where your recovery locations will be. When it comes to
the creation and the updating of the plan, we need to make sure that it's
only on a need‑to‑know basis.
Think about this,
why would you keep the BCDR plans largely confidential? It is going to point
out your greatest weakness by showing your greatest strength, right, for a
continuance of business. If a malicious actor actually knows where your
recovery is and then they induce failure,
they could also pre‑attack that location, so
confidentiality is going to be an imperative.
Also, think about how you go about updating the plan.
What kind of plan is it?
Is it only in a digital format?
Do you have written copies of it?
And what is the deportment of those written copies?
Also, inside of the business continuity framework is just a
recognition that people should be at the center of it.
How do you get to and from your recovery location?
So you got to think about transportation. Is it in a car? Is it in a plane?
What is the data that's going to be necessary?
What does the infrastructure look like?
What's the financial support and the agreement for pre‑allocation of cost? And
then what that alternate location is. Is it a physical space?
Is it a logical space, now that we have seen through the pandemic that a
lot of what happens could be from individuals' homes. The response to
business continuity says that you have to have experts that can actually
make an assessment of the disruption. Those experts on the recovery team
would then report to the executive emergency management team on their view
of how bad things are.
That would then allow the executive emergency management team to go
through the process of an official activation of the plan.
There should have been a pre‑establishment of prioritization that
allows you to know what are the most critical elements that get
recovered first, and you have to be able to monitor on an ongoing
basis, are we meeting to the plan?
Next, join me over in Creating the Business Established BCDR Strategy, and
we'll look at more of the details from a cloud perspective.