Business impact analysis is the study and analysis of the impact on your organization.
If you have a disruption in your business whatever that business might be now a business impact analysis
is a big deal and in fact as much as I loved the NIST there is one place where the NIST falls down a
little bit and that's the way they describe business impact analysis.
That three primary steps to business impact analysis are number one determine mission processes and
recovery criticality number to identify resource requirements.
Number three identify recovery priorities for system resources.
Wow.
OK.
The steel can get pretty nerdy some time.
So let's break these three steps down and make it a little bit easier for us to understand.
Number one when we're talking about determined mission processes we have to say what are the things
that we do within our I.T. infrastructure to do the voodoo we do so well.
Now here are total seminars.
We do a ton of work accessing outside servers web servers application servers things like that configuring
them.
We also do a lot of incoming business coming in for people hitting our website.
So a big mission critical process for us is our Internet and having that up and running.
Another big process for us is shooting all these videos.
We have big servers that do nothing to store all this video data.
So those two things alone are absolutely critical mission processes for total seminars.
If the water cooler went down you know what we could still do business so that would not be a mission
critical process.
Now along with that.
So now that we understand these processes are really we don't want to say process is more like functions.
Keep the internet up.
That is a mission essential function here at total seminars.
Number two make sure the servers are working.
That is a mission essential function here your total seminars.
Now another big part of that would be identification of critical systems.
If our cable modem doesn't work we have a problem and we're not going to be able to achieve our mission
essential function.
So certain pieces of equipment become really really important.
Our server for example if it goes down we've got a problem.
So what we have is actually known as a single point of failure and we want to avoid these single points
of failure by using redundancy defense in depth.
And for example I could set up to I espies I can configure raid for my raid server I can set up good
backups whatever I need to do.
The next thing I need to do is identify resource requirements.
So what do I need for these different types of resources.
Well for all of these different files where we need the server so that actually ties in a little bit
with our single point of failure concept and then last we need to identify recovery priorities for system
resources.
So now what we're talking about is if everything goes down what are the priorities what are the steps
that I have to do to get us to run the best.
So here a total seminars probably the first thing I would be doing is making sure that my internet service
provider was up in cooking making sure that my cable modem was working making sure that the router was
up and running then making sure the network was cooking.
So literally going through and prioritizing the steps necessary to get that whatever mission essential
function I might have going back up and cooking again.
So even though NIST uses some pretty fancy terms for it it's really mainly find out what are the incredibly
important processes for your business.
Identify whatever resource requirements they might need and then set up a priority too.
If they go down which ones are you going to get up first.
Now as easy as I've tried to make that there are other aspects of business impact analysis that can
get a little bit complicated.
And one of those is going to be called impact impact is a really important concept.
Now it's easy for the layperson to hear a word like that and they say what's the impact on our business.
We're going to lose money.
Well OK first of all monetary loss is an impact and that's certainly one we need to register but you
need to understand that there's more than just money involved here.
First of all probably a really big one would be property.
Now what we're talking about property we don't just mean real estate in this case we're talking about
we can lose equipment.
You know we could lose whatever it might be but it's going to be real stuff that we could lose who would
lose a van or whatever it might be.
So when we're thinking about the impact not only do we think about money but we also think about property.
Arguably you can always get property back with money.
But we treat those separately.
The other two have to do with people.
First of all we use the word safety safety in and of itself is an impact if people are getting hurt.
Well that's a problem.
And we want to avoid that.
Again it does boil back down to money but we talk about safety.
You know somebody could trip in this particular situation somebody could hurt their back trying to lift
that.
So safety by itself is an impact.
Now along with that is life don't see that too much in the security world but it does happen unfortunately
and that is literally loss of life can take place and loss of life has a huge impact in terms of how
it's going to affect your organization.
Next is going to be Finance be careful because you Google Finance is money right.
Well it is money but it's more than that.
It also might mean your ability to get money.
So your credit might come into play or your cash flows might come into play your accounts receivables.
So when we talk about an impact we talk about the finance and we break it down even more into these
different types of streams and how the money does actually affect us.
And the last one and this one's a hard when they actually put a number on is reputation.
If total seminars website went down for three days people would stop coming to it.
We would have a lack of reputation and it's hard to measure in dollars what that could possibly be.
But reputation is a really really big deal now a big killer of reputation has to do with privacy.
So let's take a moment and talk about privacy impact assessment and privacy threshold assessment.
Now privacy is a really big deal and you letting go of other people's privacy can make a huge business
impact.
So when we're talking about privacy now in other episodes we talk about personally identifiable information
PIII or personal health information.
So those two types of information PIII would be your full name your address your Social Security number
things like that personal health information would be as it implies your health history.
Any diagnoses that you've had.
Things like that so lot of people get into a lot of trouble not taking care of the privacy that they're
in charge of.
So when we're doing a business impact analysis we talk about two very specific things first of all we
talk about the privacy impact assessment the privacy impact assessments simply means what will the impact
be to us if these the privacy stuff that we're in control of where to get out one way or another and
a privacy impact assessment really is looking at what laws and regulations and what obligations that
we might run into and then you know what we would have to be doing if that were to get out.
So to avoid privacy impact problems what we do is called a privacy threshold assessment a privacy threshold
assessment simply means that you're going out to do an assessment you have certain types of data and
you go out and say you know what is this data where is this data how are we storing this data.
So privacy threshold assessments are often an in-house document.
So I've got an example of a PTA that came from US Aid Society.
We pull that up and we can talk a little bit about what you might see in a privacy threshold assessment.
So if you take a look on this one.
This is a big long document but if you take a look you'll see that this is an internal questionnaire.
And what they're interested in is they're saying what type of paper documents systems electronic media
digital collaboration tools or services and or mobile services you to employ to collect use maintain
or disseminate information.
So we're really talking about in this one particular example where within the organization they're not
sure what other parts of the organization are doing with this type of personal information.
And this gives them idea because you're not always sure somebody comes up with a new web page for you
to enter your social security number.
Have they made that particular page robust so that bad guys can't get into it.
So a PDA and a PTA are both done in order to understand what the impact of the loss of personal information
can do to a particular business.
So the last one I want to go over is RTU and RPO.
Now our Teoh's stands for recovery time objective and RPO stands for recovery point objective.
Make sure you know what these are the recovery time objective is the minimum time necessary to restore
a critical system to operation.
Now it could also mean the maximum time that a critical system can be down without substantial impact
so you can actually look at the art in two different ways.
Number one what's the minimum time necessary.
This is down that we can bring it back on line.
And then the other way is how long is this down before we're in trouble so even though these seem like
two different terms if you think about it for a little bit they can actually pretty much mean the same
thing.
I'm not exactly but they're close.
If I have a router that goes down.
All right the minimum time necessary for me to restore that back to operation can in many cases doesn't
always have to be equal to the maximum time that a critical system can be down without some form of
substantial impact.
Now keep in mind the term substantial is a very soft term and part of business impact analysis is to
try to get an idea of what substantial means for any particular organization.
Now recovery point objective is the maximum amount of data that can be lost without substantial impact.
Now here are total seminars we're backing stuff up almost constantly and we have to we have accounts
receivable coming in we have accounts payable and you know do you guys like these training videos and
test banks and vouchers from chapatti exams and things like that and you would be very crabby at me
if we lost your data and I couldn't give you the stuff that you paid for.
So for us here in total seminars it's our recovery point objective is a very very small space.
It's less than 24 hours worth of data because usually if it's 24 hours we can call you back but any
more that we would be in trouble.
Wow.
So business impact analysis covers a lot of terminology that you'll be seeing on the exam.
What I want to stress to you is that compt He had barely touches all that business impact analysis says
business impact analysis is a huge huge concept but at least for the exam.
Make sure you're comfortable with things like recovery time objective and personal information and you'll
do just fine.
In.