2 Discussion Responses - Peer Critique
nofreetime
peer_paper_2.docxIntroduction
Companies are increasingly aware of the crucial role information technology plays in their success and survival. In addition, information is a corporate asset and protecting it and the associated technology, systems and services adds value to the company (Herold, 2010). Information security is aligned with and complements business goals, such as gaining new customers, increasing market share, operating more efficiently, attracting qualified employees, boosting revenues, and cutting costs (Fitzgerald, 2012).
If employees at all levels of the organization do not know how to protect one of its most valuable business assets, its information, the company risks not only the damage or loss of the asset but also takes the chance of being non-compliant with the plethora of rules, regulations and laws that mandate that information be protected (Herold, 2010). By jeopardizing information and not making information security a priority, a company risks its reputation and future.
Overview
Not everyone is aware of the nature and scope of the unique threats and catastrophes to which IT is vulnerable. The types of incidents that could seriously impact the functioning of a company’s IT and therefore have devastating effects on business operations are:
• damage, loss or denial of access to vital hardware, software, networks or facilities
• Web-based Software-as-a Service failures
• damage to critical providers, distributors or other third party services
• contamination of crucial information
• blackmail or industrial espionage
• intentional intrusion
• cyber-attacks on critical IT systems (Holman & Houser, 2011 ).
Information Security in DR/BC Planning
Virtually all business functions rely on or utilize IT systems and services and therefore these threats may target or primarily damage IT but affect all company operations. Acknowledging that information security is a company-wide, not just an IT department priority, clarifies the need to specifically address information security in the company’s Disaster Recovery (DR) and Business Continuity Plan (BCP) (Granneman, 2015).
Integrating information security with overall DR/BCM processes will help all employees recognize elements that constitute an IT-specific disaster such as a major cyber-attack or complete server failure (Cisco, 2008). It also educates employees on ways IT could be affected in company-wide catastrophes, such as fires, man-made or natural disasters (Cisco, 2008). The IT portion of the DR/BCP will pre-define the point at which service interruptions require the launch of recovery operations (Janco, 2015). In addition, it will set and clarify realistic time frames within which the company’s IT systems and levels of service can be restored (Janco, 2015). The IT systems and services recovery process will be streamlined because roles and responsibilities will have already been defined and assigned (Slater, 2015). Understanding how IT assets such as hardware, software, facilities and staff will be recovered or utilized to respond to a crisis will ensure that recovery and restoration of IT systems and services are consistent with the company’s overall DR/BCP (Bailey, Brandley, & Kaplan, 2013).
By having the entire organization examining IT along with the technical and operational aspects of DR/BCP, risks can be managed and damage can be mitigated (Herold, 2010). Combining coordination of response plans with clear, accessible and current IT incident response documents will ensure that every level within the company can react quickly and appropriately in a crisis (Bailey, Brandley, & Kaplan, 2013). Lastly, the organization as a whole can learn not just ways to recover from an IT incident, data breach, cyber-attack or calamity but also ways to prevent those types of events from occurring (Bailey, Brandley, & Kaplan, 2013)
The CISO
The Chief Information Security Officer (CISO) reports to either the CIO or CSO and is the key IT person to “interpret regulations, establish policy, influence employee behavior and monitor for appropriate outcomes” (Engle & Guttman, 2014). She or he understands the compliance requirements and government regulations the company must follow, coordinates with multiple departments in the development of security budgets, and works with IT staff and all levels within the organization to ensure that information is being protected and security protocols are followed (Poremba, 2015). The top priority of the CISO is to protect the organization’s information and computer networks from cyber-attacks and catastrophes (Poremba, 2015). Therefore, she is the executive who will spearhead the integration of IT with the company’s DR/BCP and have ongoing responsibility for the IT DR/BCP.
CISO Roles and Responsibilities for DR/BCP Planning
In order to incorporate information security into the company’s DR/BCP, IT-specific incidents must be classified, causes and effects identified, probability and severity evaluated, and business impact and priority assessed and categorized (Cisco, 2008). The CISO is uniquely qualified to assess and analyze the practices and events that could affect IT infrastructure and systems and threaten important data (Bailey, Brandley & Kaplan, 2013). The end results of the CISO’s formal assessment will be details of the IT resources needed for data back-ups and hardware and software recovery (Masserini, 2015). The CISO will outline responses to cybersecurity incidents or crises that will limit damage, reduce incident response time and expense, increase stakeholder confidence and preserve business reputation (Bailey, Brandley & Kaplan, 2013).
Lists of key personnel will be created and the processes for important decision making will be streamlined (Masserini, 2015). In addition, the CISO will create readily accessible rapid-response guides for a variety of common incidents (Masserini, 2015).
The CISO will develop the integration of IT into DR/BCP as a “stand-alone” strategy that is not dependent on the personnel who created it to work (CSO, 2005).
The CISO can also quantify the amount of revenue that can be lost as a result of an IT-impacting event and detail the resources needed to ensure that the maximum is not exceeded (Masserini, 2015). This is essential information for the company’s overall BIA. To prepare for DR/BCP implementation, the CISO will develop cost estimates and collect pricing information that is within budget.
CISO Roles and Responsibilities for DR/BCP Implementation
Once the CISO specifies the resources necessary to properly respond to a variety of IT security incidents, she will work with other departments to develop and prioritize the goods, services, applications, support, staff, equipment and facilities necessary to accomplish IT DR and BCP (MyMG, 2011). When possible the CISO will “test drive” products and technologies prior to procurement (CSO, 2005).
The procurement process will include the evaluation of vendor supported recovery strategies such as “hot sites” in which offsite data facilities are fully configured with commonly used IT equipment and software (ready.gov, 2012). There will also be widespread utilization of recent IT service trends such as virtualization, cloud computing, mobile computing and social networks (Slater, 2015).
The CISO will research potential suppliers that can provide the required products and services according to the agreed-upon specifications (MyMG, 2011). There will be an emphasis on using standardized equipment and readily available software and systems to facilitate recovery and restoration processes and reduce costs (ready.gov, 2012).
Once the CISO has determined the best value and awarded contracts and issued purchase orders, she will continue to manage the procurement process by ensuring products and services are provided in accordance with the contract and purchase order terms (Procure Point, 2015). The CISO is best qualified and well positioned to evaluate the performance of the equipment, systems, applications and software and measure the reliability and value of the vendors and suppliers (Procure Point, 2015).
CISO Roles and Responsibilities for DR/BCP Execution
After the IT DR/BC plans are devised and the necessary goods and services are procured, the CISO will be ready to put the DR/BCP into action during an incident and manage recovery operations. The CISO will supervise training so that all employees know their roles and responsibilities and be prepared to provide the appropriate level of support in the IT DR/BCP (Janco, 2015). The CISO test this training by conducting realistic company-wide DR and BCP exercises to make sure all employees practice responding to a crisis (Slater, 2015). The CISO will hold postmortem examinations that objectively evaluate the company’s performance after each exercise and endeavor toward constant improvement (CSO, 2005). In addition, the CISO will form and maintain good rapport with local emergency response agencies (Slater, 2015). The CISO will constantly review and refine the IT department’s contribution to the DR/BCP. She will also stay abreast of new technology that can aid in the DR/BCP process.
Best practices for implementing DR/IT Service Continuity
Following are some of the best disaster recovery and IT service continuity practices:
Define Disaster
It is important to have clear criteria for declaring an emergency or incident that will set response and recovery processes in motion (Janco, 2015). There also need to be pre-determined processes and procedures for the allocation of resources and assignment of responsibilities and personnel (Janco, 2015).
Proactively Address Issues
Identify and address issues before they adversely affect the company or disrupt business operations. Potential problems and threats need to be anticipated and thwarted before they impact the organization (Bailey, Brandley, & Kaplan, 2013).
Identify Key Personnel
An executive such as a CISO should have overall responsibility for implementing IT DR and BCP and integrating the plans throughout all levels of the organization (Bailey, Brandley, & Kaplan, 2013). In addition, key personnel who are crucial to response and recovery efforts should be identified along with their designated back-ups in the event they are unavailable (Slater, 2015).
Establish Good Relationships
The executive in charge of IT DR and BCP as well as key DR/BCP personnel should forge and maintain good working relationships with local emergency response agencies (Slater, 2015). In addition, service-level agreements and good rapport should be maintained with external IT DR/BCP providers, consultants and experts (Janco, 2015).
Ensure Good Working Order
Ensuring that hardware, software, systems and facilities are properly installed and configured will dramatically reduce future problems and downtime (Janco, 2015).
Document, Document, Document
Validate that the IT DR and BC plans are constantly evaluated, updated and easily accessible to the entire company (Slater, 2015).
Conclusion
Information security is an integral part of disaster recovery and business continuity planning and cannot be developed in isolation from other business processes (Slater, 2015). It requires regular communication across all levels of the organization and a subject matter expert, such as a CISO, to assess, identify and implement the best information security practices and integrate them into the company’s DR and BCP.
References
Bailey, T., Brandley, J. & Kaplan, J. (2013). How good is your cyber incident-response plan? McKinsey & Company. Retrieved fromhttp://www.mckinsey.com/insights/ business_technology/how_good_is_your_cyberincident_response_plan
Cisco. (2008).Disaster recovery: Best practices. Cisco Systems. Retrieved from http://www.cisco.com/en/US/technologies/collateral/tk869/tk769/white_paper_c11-453495.html
CSO Contributor. (2005, March 1). Top eight best practices for I.T. disaster recovery. CSO. Retrieved from http://www.csoonline.com/article/2118026/business-continuity/top-eight-best-practices-for-i-t--disaster-recovery.html
Engle, B. & Guttman, R. (2014, October 28). The evolution of the CISO role and organizational readiness. CSO. Retrieved from http://www.csoonline.com/article/2838371/security-leadership/the-evolution-of-the-ciso-role-and-organizational-readiness.html
Fitzgerald, Todd. (2012). Interacting with the C-suite. In Information security governance simplified: from the boardroom to the keyboard. Retrieved from http://library.books24x7.com.ezproxy.umuc.edu/assetviewer.aspx?bookid=47187
Granneman, J. (2015, February). How should organizations make a cybersecurity policy a top priority? TechTarget. Retrieved from http://searchsecurity.techtarget.com/answer/How-should-organizations-make-a-cybersecurity-policy-a-top-priority
Herold, R. (2010). Managing an information security and privacy awareness and training program (2nd ed.). New York: Auerbach Publications. Retrieved from http://www.infosectoday.com/Articles/Security_Awareness_Training.htm
Holman, E. & Houser, K. (2011).ITSCM (IT service continuity management) overview: ITIL®'s IT disaster recovery and business continuity management. Share. Retrieved from https://share.confex.com/.../Session%2010043%20Continuity%20Manag
Janco. (2015). DRP and BCP best practices. Janco Associates, Inc. Retrieved from http://www.e-janco.com/DisasterPlanningBuinessContinuityBestPractices.htm
Masserini, J. (2015, January 26). Business continuity planning, The CISOs secret weapon. Security Current. Retrieved fromhttp://www.securitycurrent.com/en/writers/john-j-masserini/business-continuity-planning-the-cisos-secret-weapons
MyMG Team. (2011). Project procurement management: 5 steps of the process. My MG. Retrieved fromhttp://www.mymanagementguide.com/project-procurement-management/
Procure Point. (2015). Six stage process for procurement. Procure Point. Retrieved from https://www.procurepoint.nsw.gov.au/policy-and-reform/goods-and-services/six-stage-process-procurement
Poremba, S. (2015, April 15). A CISO’s job description: What is a day in the life of the CISO? SunGard Blog. Retrieved fromhttp://blog.sungardas.com/2015/04/a-cisos-job-description-what-is-a-day-in-the-life-of-the-ciso/
Ready.gov. (2012). IT disaster recovery plan. Ready.gov. Retrieved from http://www.ready.gov/business/implementation/IT
Slater, D. (2015, May 20). Business continuity and disaster recovery planning: The basics. CSO. Retrieved from http://www.csoonline.com/article/2118605/disaster-recovery/pandemic-preparedness-business-continuity-and-disaster-recovery-planning-the-basics.html?nsdr=true&page=2
