Project Part 4: Business Impact Analysis (BIA) and Business Continuity Plan (BCP)
spy1950
OriginalityReport.pdf
6/18/2021 Originality Report
https://ucumberlands.blackboard.com/webapps/mdb-sa-BB5a31b16bb2c48/originalityReport/ultra?attemptId=7d0e058f-1fac-4a32-b591-c16daff84efc… 1/12
%68
%5
SafeAssign Originality Report Summer 2021 - Info Security & Risk Mgmt (ISOL-533-A04) - First Bi-Te… • Risk management project part 4
%73Total Score: High riskAditya Chimbalkar Submission UUID: 14e2604d-9ddb-7a45-2cca-e10978c63fec
Total Number of Reports
1 Highest Match
73 % RISK MANAGEMENT PROJECT PART 4 new…
Average Match
73 % Submitted on
06/10/21 10:35 AM EDT
Average Word Count
1,431 Highest: RISK MANAGEMENT PROJECT PA…
%73Attachment 1
Institutional database (14)
Student paper Student paper Student paper
Student paper Student paper Student paper
Student paper Student paper Student paper
Student paper Student paper Student paper
Student paper Student paper
Global database (2)
Student paper Student paper
Top sources (3)
Excluded sources (0)
View Originality Report - Old Design
Word Count: 1,431 RISK MANAGEMENT PROJECT PART 4 new.docx
7 3 2
8 4 1
13 11 5
6 12 9
15 10
16 14
7 Student paper 3 Student paper 2 Student paper
Running head: 1
RISK MANAGEMENT PROJECT PART 4 3
RISK MANAGEMENT PROJECT PART 4
Aditya Chimbalkar
University of the Cumberlands
RISK MANAGEMENT PROJECT PART 4
Task 1
Business impacts analysis (BIA) The overview
This Business Impact Analysis (BIA) is always developed as a major part of the contingency planning in the process of sorting the company issue for the HNe-
texcahnge Message system, the HNetconnect Directory system and the HNetpay payment system. This has been made for the health network, Inc. (Health Network) The system description The health care network and its operation are divided into three data branches and they are all over the company product line. The data has many servers like 1000 and 350 laptops and that helps to provide the services to the employee called mobile devices. The organization is huge and its headquar-
ters is in Minneapolis and the other two branches are in Portland, Arlington, Virginia and Oregon. Each of the offices has its data center in which the actual production server and its system are operated by the vendors who are the third party (Mohapatra & Sachdeva, 2018). Its infrastructure has the HNET Exchange server, HNET
Pay Payment Database as well as HNET Connect Database Directory. In addition to that, it also has the other where HNET Exchange Server has been termed as the main generator of the company revenue. The services are all secure since they are conducted in the electronic medium and that is done between the customer and the clinic. The HNetpay so the portal that is used for the payments and it is used by the HNetExchange’s customers that helps to facilitate the secure payments The
1
2
3
4
5
6/18/2021 Originality Report
https://ucumberlands.blackboard.com/webapps/mdb-sa-BB5a31b16bb2c48/originalityReport/ultra?attemptId=7d0e058f-1fac-4a32-b591-c16daff84efc… 2/12
HNetcoonect is the database that has been given the list of health care practitioners and doctors, the hospitals and the clinics. This helps the customers to be able to locate their specialist or the health care they need just like any other e-commerce websites whereby all customer and service providers can get information and pro- file, contact information as well as other information that can be required to get proper service (Devlen, 2009). The other operational firewall, as well as the server, are like: · External Firewall · Web Server · Internal Firewall · Email Server · Database Server Business Function or Process Business
Impact
Factor Recovery
Time
Objective (hours/days IT Systems/Apps
Infrastructure Impacts
Telephonic Customer Service Level 3 24 System Application
Domain
Email Customer Service Level 1 5 System Application
Domain
Domain Servers Level 2 22 LAN to WAN Domain
Email and Messaging Service Level 2 24 System Application
Domain
Internet and Intranet Level 2 24 Remote Access Domain
Website Level 2 24 System Application
Domain
HR resource and Accounts Level 2 24 LAN Domain
Chat-based Customer Service Level 2 24 LAN Domain
Technical Support Level 3 1-2 days LAN Domain
Accounting and Finance Support Level 4 24 System Application
Domain
Marketing and Events Level 4 2-3 days System Application
Domain
Sales Level 1 24 System Application
Domain
Communication with another
department Level 2 24 System Application
Domain
Identify Outage Impacts and Estimated Downtime
The estimated downtime
The table that I will draw below will show the MTD, RPO and the RTO for the entire healthcare processes that depend on the HNetConnect Directory system,
HNetExchange Message system and the HNetPay Payment system
Mission/Business Process
For HNetExchange MTD
RTO RPO
Telephonic Customer service 48 hours 24 hour 5 hours
Email Customer Service
48 hours
24 hours 4 hours
4
6
7
7
2
7
2
7
2
7
7
7
8
6
8
7
9
3
3
6/18/2021 Originality Report
https://ucumberlands.blackboard.com/webapps/mdb-sa-BB5a31b16bb2c48/originalityReport/ultra?attemptId=7d0e058f-1fac-4a32-b591-c16daff84efc… 3/12
Mission/Business Process
For HNetConnect MTD
RTO RPO
Internet and Intranet 48 hours 24 hours 3 hours
Email and messaging
48 hours
24 hours
4 hours
Mission/Business Process
For HNetPay MTD
RTO RPO
Accounting and Finance
Support 48 hours 24 hours 4 hours
Website
48 hours
24 hours
4 hours
Task 2 Business Continuity Plan
Emergency management standards
Data backup policy
This is an activity that needs to be conducted on any organization regularly so that no data is lost. This entails the audit logs as well as the irreplaceable file. This is be- cause they are expensive to replace. The storage media used as a backup should be stored in secure places and a geographically isolated place away from the
original data. Health care also needs to have a policy that helps to dictate the data and documents and their retention and for how long that information is to be re- tained (Savage, 2002). The IT team has the role of backing up data and they follow the following standards when doing backup and archiving. Tape retention
policy. The backup media is in the store that is secure location and they are always from environmental hazards and they are geographically isolated from the original data or location that housing the system. Billing tapes. The tapes that are more than 3 years are in this case destroyed every six months. The tapes that are
less than three years old should be stored in another locally off-site. System image tapes. This entails the making of a copy of the images and that copy is made once every week. This is also stored off-site and this is done by the system supervisor of the activity.
7
3
7
10
3
11
3
7
7
7
12 7
Task 3- Disaster Recovery Plan
DISASTER RECOVERY PLAN FOR <HNETPAY>
OVERVIEW
PRODUCTION
SERVER Location: Minneapolis, Portland, Arlington
IT
INFRASTRUCTURE HNET Connect Directory Database
BACKUP STRATEGY
FOR SYSTEM ONE
DAILY / MONTHLY / QUARTERLY Daily
DISASTER
RECOVERY
PROCEDURE
11
11
3
7
6/18/2021 Originality Report
https://ucumberlands.blackboard.com/webapps/mdb-sa-BB5a31b16bb2c48/originalityReport/ultra?attemptId=7d0e058f-1fac-4a32-b591-c16daff84efc… 4/12
RISK #1: LOSS OF
COMPANY DATA DUE
TO HNETCONNECT
HARDWARE
REMOVED FROM
PRODUCTION
SYSTEMS. Online services are disrupted, and clients find difficulty in
Viewing and comparing the doctors and clinics. This results
In finding the correct doctor and clinic for superior care. Regular Backups should be done, and standard access
Control techniques should be followed.
RISK #2: LOSS OF
CUSTOMERS DUE TO
PRODUCTION
OUTAGES. Supported clinic and the right doctor cannot be allocated to the
customer and maintain DRP in case of the primary server
Collapses.
DISASTER RECOVERY PLAN FOR <HNETEXCHANGE> OVERVIEW
PRODUCTION SERVER Location: Portland, Minneapolis, Arlington
IT INFRASTRUCTURE HNET Exchange Server
BACKUP STRATEGY
FOR SYSTEM ONE
DAILY / MONTHLY / QUARTERLY Daily
SYSTEM DISASTER
RECOVERY
PROCEDURE
RISK #1: LOSS OF
COMPANY DATA DUE
TO HNETEXCHANGE
HARDWARE REMOVED
FROM PRODUCTION
SYSTEMS. Exchange of the information between the customers and
staff members is improper and results in organizations
Revenue. Scheduling regular backups and ACT (Access
Control Techniques) should be implemented
RISK #2: LOSS OF
CUSTOMERS DUE TO
PRODUCTION
OUTAGES. Supported care cannot be assigned to the customers. Maintaining an effective DRP and servers can reduce the
Impact.
Task 4: Computer Incident Response Team Plan Appendix A the incident response worksheet
Preparation: the tools, the applications, the laptops and communications devices that are needed so that to address the computer incidence responses of the differ-
7
13
7
7
7 11
3
7
1
7
7
7
7
6/18/2021 Originality Report
https://ucumberlands.blackboard.com/webapps/mdb-sa-BB5a31b16bb2c48/originalityReport/ultra?attemptId=7d0e058f-1fac-4a32-b591-c16daff84efc… 5/12
Source Matches (64)
Student paper 100%
Student paper 78%
Student paper 84%
Student paper 81%
Student paper 79%
Student paper 84%
ent breaches? Identification: whenever the incident has been reported it needs to be identified, then classified and then documented in this step and this information below is required. Identify the nature of the incident
What if the organization's process has been most impacted? HNET Connect, HNET pay as well as NET Exchange
What of the threats was identified? Loss of the highly confidential data and information
Which are the risk factors of the incidents? Which are highly crucial What are the RPO, RTO, and MTD and the assigned process in the business? RTO -4
hours, RPO-3 Hours, MTD12Hours
Containment: the main objective is mainly to limit the scope as well as the magnitude of the security incident as fast as possible rather than allowing the incident
to proceed to gain the evidence of identification of the perpetrator. · Involved the communication that happens between staff and the user Eradication: removal of the computer-related incidents or the cases of breaches and their effects. · The data and information can only be access by the authorized user and persons. Recov- ery: this step is responsible for bringing back the system and the production of the IT system, the applications as well as the assets that have been affected by
the security incident. · Backup is used to restore the data that was lost · In this case, if incident business continuity is always implemented · The plans including
the BIA, BCP as well as DRP, they also need to update that so that to reduce the impacts of the incident. References
Mohapatra, S. C., & Sachdeva, P. (2018). Business Impact Analysis (BIA) in Health Sector: The call for the day. Indian Journal of Preventive & Social Medicine, 49(3),
4-4. Savage, M. (2002). Business continuity planning. Work study. Devlen, A. (2009). How to build a comprehensive business continuity programme for a
healthcare organisation. Journal of business continuity & emergency planning, 4(1), 47-61.
7
13
1
1 7
7
14
7
2
15 16
1
Student paper
University of the Cumberlands
Original source
University of Cumberlands
2
Student paper
Business impacts analysis (BIA) The overview
Original source
Business Impact Analysis (BIA) Overview
3
Student paper
This Business Impact Analysis (BIA) is always developed as a major part of the contin- gency planning in the process of sorting the company issue for the HNetexcahnge Mes- sage system, the HNetconnect Directory system and the HNetpay payment system.
Original source
This Business Impact Analysis (BIA) is developed as part of the contingency planning pro- cess for the HNetExchange Message system, HNetConnect Directory system and HNetPay Payment system
4
Student paper
The organization is huge and its headquarters is in Minneapolis and the other two branches are in Portland, Arlington, Virginia and Oregon.
Original source
The organization has its headquarters in Minneapolis and has two corporate branches in Portland, Oregon and Arlington, Virginia
5
Student paper
Its infrastructure has the HNET Exchange server, HNET Pay Payment Database as well as HNET Connect Database Directory.
Original source
The HNET Exchange server, HNET Connect directory database, HNET Pay payment data- base will be impacted
4
Student paper
· External Firewall · Web Server · Internal Firewall · Email Server · Database Server Busi- ness Function or Process Business
Original source
· Email Server · Database Server · Web Server · Internal Firewall · External Firewall
6/18/2021 Originality Report
https://ucumberlands.blackboard.com/webapps/mdb-sa-BB5a31b16bb2c48/originalityReport/ultra?attemptId=7d0e058f-1fac-4a32-b591-c16daff84efc… 6/12
Student paper 68%
Student paper 80%
Student paper 80%
Student paper 87%
Student paper 81%
Student paper 86%
Student paper 73%
Student paper 87%
Student paper 91%
Student paper 94%
6
Student paper
Objective (hours/days IT Systems/Apps
Original source
Objective IT Systems/Apps Infrastructure
7
Student paper
Telephonic Customer Service Level 3 24 System Application
Original source
Telephonic Customer Service Level 3 24 Hrs
7
Student paper
Email Customer Service Level 1 5 System Application
Original source
Email Customer Service Level 1 5 Hrs
2
Student paper
Domain Servers Level 2 22 LAN to WAN Domain
Original source
Domain Servers Level 2 A day LAN to WAN Domain
7
Student paper
Email and Messaging Service Level 2 24 System Application
Original source
Email and Messaging Service Level 2 24 Hrs
2
Student paper
Internet and Intranet Level 2 24 Remote Access Domain
Original source
Internet and Intranet Level 2 A day Remote Access Domain
7
Student paper
Website Level 2 24 System Application
Original source
Website Level 2 24 Hrs
2
Student paper
HR resource and Accounts Level 2 24 LAN Domain Chat-based Customer Service Level 2 24 LAN Domain
Original source
HR resource and Accounts Level 2 A day LAN Domain Chat based Customer Service Level 2 A day LAN Domain
7
Student paper
Technical Support Level 3 1-2 days LAN Domain Accounting and Finance Support Level 4 24 System Application
Original source
Technical Support Level 3 1-2 Days LAN Domain Accounting and Finance Support Level 4 24 Hrs
7
Student paper
Marketing and Events Level 4 2-3 days System Application
Original source
Marketing and Events Level 4 2-3 Days System Application Domain
6/18/2021 Originality Report
https://ucumberlands.blackboard.com/webapps/mdb-sa-BB5a31b16bb2c48/originalityReport/ultra?attemptId=7d0e058f-1fac-4a32-b591-c16daff84efc… 7/12
Student paper 72%
Student paper 70%
Student paper 75%
Student paper 72%
Student paper 84%
Student paper 65%
Student paper 100%
Student paper 78%
Student paper 84%
Student paper 75%
7
Student paper
Sales Level 1 24 System Application
Original source
Sales Level 1 24 Hrs
8
Student paper
department Level 2 24 System Application
Original source
Inter Department communication system Level 2 24 hours System Application domain
6
Student paper
Identify Outage Impacts and Estimated Downtime
Original source
3.1.1 Identify Outage Impacts and Estimated Downtime
8
Student paper
The table that I will draw below will show the MTD, RPO and the RTO for the entire health- care processes that depend on the HNetConnect Directory system, HNetExchange Mes- sage system and the HNetPay Payment system
Original source
The table below identifies the MTD, RTO, and RPO for the organizational business pro- cesses that rely on theHNetExchange Message system, HNetConnect Directory system and HNetPay Payment system
7
Student paper
Mission/Business Process For HNetExchange MTD
Original source
Mission/Business Process For HNetExchange MTD RTO RPO
9
Student paper
Telephonic Customer service 48 hours 24 hour 5 hours
Original source
Email Customer Service 48 Hours 24 Hours 4 Hours
3
Student paper
Email Customer Service
Original source
Email Customer Service
3
Student paper
24 hours 4 hours
Original source
48 hours 24 hours 4 hours
7
Student paper
Mission/Business Process For HNetConnect MTD
Original source
Mission/Business Process For HNetConnect MTD RTO RPO
3
Student paper
Internet and Intranet 48 hours 24 hours 3 hours Email and messaging
Original source
48 hours 24 hours 4 hours Email and messaging service
6/18/2021 Originality Report
https://ucumberlands.blackboard.com/webapps/mdb-sa-BB5a31b16bb2c48/originalityReport/ultra?attemptId=7d0e058f-1fac-4a32-b591-c16daff84efc… 8/12
Student paper 84%
Student paper 83%
Student paper 93%
Student paper 71%
Student paper 100%
Student paper 100%
Student paper 68%
Student paper 86%
Student paper 76%
7
Student paper
Mission/Business Process For HNetPay MTD
Original source
Mission/Business Process For HNetPay MTD RTO RPO
10
Student paper
Accounting and Finance
Original source
Accounting and finance support
3
Student paper
Support 48 hours 24 hours 4 hours
Original source
48 hours 24 hours 4 hours
11
Student paper
Task 2 Business Continuity Plan
Original source
Business Continuity Plan
3
Student paper
Emergency management standards
Original source
Emergency management standards
7
Student paper
Data backup policy
Original source
Data backup policy
7
Student paper
The storage media used as a backup should be stored in secure places and a geographic- ally isolated place away from the original data.
Original source
Backup media should be stored in a secure, geographically separate location from the original and isolated from environmental hazards
7
Student paper
Tape retention policy. The backup media is in the store that is secure location and they are always from environmental hazards and they are geographically isolated from the ori- ginal data or location that housing the system.
Original source
Tape retention policy Backup media is stored at locations that are secure, isolated from environmental hazards, and geographically separate from the location housing the system
12
Student paper
The tapes that are more than 3 years are in this case destroyed every six months.
Original source
Tapes if used which are greater than 3 years are destroyed in every six months
6/18/2021 Originality Report
https://ucumberlands.blackboard.com/webapps/mdb-sa-BB5a31b16bb2c48/originalityReport/ultra?attemptId=7d0e058f-1fac-4a32-b591-c16daff84efc… 9/12
Student paper 92%
Student paper 86%
Student paper 100%
Student paper 96%
Student paper 100%
Student paper 74%
Student paper 76%
Student paper 64%
Student paper 100%
7
Student paper
The tapes that are less than three years old should be stored in another locally off-site. System image tapes.
Original source
Tapes less than three years old must be stored locally off-site System image tapes
11
Student paper
Task 3- Disaster Recovery Plan DISASTER RECOVERY PLAN FOR <HNETPAY>
Original source
Disaster Recovery Plan Disaster Recovery Plan for <HNetPay>
11
Student paper
Minneapolis, Portland, Arlington
Original source
Minneapolis, Arlington, Portland
3
Student paper
INFRASTRUCTURE HNET Connect Directory Database
Original source
IT INFRASTRUCTURE HNET Connect Directory Database
7
Student paper
DAILY / MONTHLY / QUARTERLY Daily
Original source
Daily / Monthly / Quarterly Daily
7
Student paper
Online services are disrupted, and clients find difficulty in
Original source
Online services are disrupted, and clients find difficulty in viewing and comparingthe doc- tors and clinics
13
Student paper
In finding the correct doctor and clinic for superior care. Regular Backups should be done, and standard access
Original source
This results in find the correct doctor and clinic for superior care Regular Backups must be done, and standard access control techniques should be followed
7
Student paper
Supported clinic and the right doctor cannot be allocated to the customer and maintain DRP in case of the primary server
Original source
Supported clinic and right doctor cannot be allocated to the customer and maintain DRP in case of primary server collapses Supported clinic and right doctor cannot be allocated to the customer and maintain DRP in case of primary server collapses
7
Student paper
DISASTER RECOVERY PLAN FOR <HNETEXCHANGE>
Original source
Disaster Recovery Plan for <HNetExchange>
6/18/2021 Originality Report
https://ucumberlands.blackboard.com/webapps/mdb-sa-BB5a31b16bb2c48/originalityReport/ultra?attemptId=7d0e058f-1fac-4a32-b591-c16daff84e… 10/12
Student paper 100%
Student paper 100%
Student paper 100%
Student paper 100%
Student paper 68%
Student paper 69%
Student paper 70%
Student paper 97%
Student paper 100%
Student paper 100%
7
Student paper
PRODUCTION SERVER Location:
Original source
PRODUCTION SERVER Location
11
Student paper
Portland, Minneapolis, Arlington
Original source
Minneapolis, Arlington, Portland
3
Student paper
IT INFRASTRUCTURE HNET Exchange Server
Original source
IT INFRASTRUCTURE HNET Exchange Server
7
Student paper
DAILY / MONTHLY / QUARTERLY Daily
Original source
Daily / Monthly / Quarterly Daily
1
Student paper
Exchange of the information between the customers and
Original source
Exchange of information between the customers and staff members is improper
7
Student paper
staff members is improper and results in organizations
Original source
Exchange of the information between the customers and staff members is improper and results in organizations revenue
7
Student paper
Scheduling regular backups and ACT (Access
Original source
Scheduling regular backups and ACT (Access Control Techniques) should be implemented
7
Student paper
Supported care cannot be assigned to the customers. Maintaining an effective DRP and servers can reduce the
Original source
Supported care cannot be assigned to the customers Maintaining an effective DRP and servers can reduce the impact
7
Student paper
Computer Incident Response Team Plan Appendix A the incident response worksheet
Original source
Computer Incident Response Team Plan Appendix A – Incident Response Worksheet
7
Student paper
Identify the nature of the incident
Original source
Identify the nature of the incident
6/18/2021 Originality Report
https://ucumberlands.blackboard.com/webapps/mdb-sa-BB5a31b16bb2c48/originalityReport/ultra?attemptId=7d0e058f-1fac-4a32-b591-c16daff84ef… 11/12
Student paper 87%
Student paper 86%
Student paper 79%
Student paper 78%
Student paper 67%
Student paper 62%
Student paper 68%
Student paper 68%
13
Student paper
HNET Connect, HNET pay as well as NET Exchange
Original source
HNET pay, HNET Connect, NET Exchange
1
Student paper
Loss of the highly confidential data and information
Original source
Loss of highly confidential information
1
Student paper
Which are highly crucial What are the RPO, RTO, and MTD and the assigned process in the business?
Original source
What MTD, RPO, and RTO are assigned to the business process
7
Student paper
RTO -4 hours, RPO-3 Hours, MTD12Hours
Original source
RTO- 4 Hours, MTD- 12Hours, RPO-3 Hours
7
Student paper
the main objective is mainly to limit the scope as well as the magnitude of the security in- cident as fast as possible rather than allowing the incident to proceed to gain the evid- ence of identification of the perpetrator.
Original source
The immediate objective is to limit the scope and magnitude of the computer/security- related incident as quickly as possible, rather than allow the incident to continue to gain evidence for identifying and/or prosecuting the perpetrator
14
Student paper
this step is responsible for bringing back the system and the production of the IT system, the applications as well as the assets that have been affected by the security incident.
Original source
Step 5 – Recovery – Recovery is specific to bringing back into production those IT systems, applications, and assets that were affected by the security-related incident
7
Student paper
· Backup is used to restore the data that was lost · In this case, if incident business con- tinuity is always implemented · The plans including the BIA, BCP as well as DRP, they also need to update that so that to reduce the impacts of the incident.
Original source
· Backups restore the lost data · In case of incident Business Continuity plan is implemen- ted · All the plans including BCP, DRP, BIA need to be updated with security policies to re- duce the impact of the incident
2
Student paper
Business Impact Analysis (BIA) in Health Sector:
Original source
Business Impact Analysis (BIA) Overview
6/18/2021 Originality Report
https://ucumberlands.blackboard.com/webapps/mdb-sa-BB5a31b16bb2c48/originalityReport/ultra?attemptId=7d0e058f-1fac-4a32-b591-c16daff84e… 12/12
Student paper 100%
Student paper 100%
15
Student paper
Business continuity planning.
Original source
Business Continuity Planning
16
Student paper
How to build a comprehensive business continuity programme for a healthcare organisa- tion. Journal of business continuity & emergency planning, 4(1), 47-61.
Original source
How to build a comprehensive business continuity programme for a healthcare organisa- tion Journal of Business Continuity & Emergency Planning, 4, 1, 47-61
