Critical Analysis 2

Introduction

As a company’s comes to an agreement between senior’s executives (CEO, CIO and CISO) that cybersecurity its cyberspace is the paramount of its survival, they also must realize that this is just the begging step of many that must be undertaken. As many cyberattacks has come into light every day, the following steps to undertake is disaster recovery plan, and business continuity plan (DR/BCP). Disaster recover it is a planned process that business put in place to recover from a disaster (cyberattack on its IT infrastructure) including but not limited to IT equipment such as routers, switches, firewalls, servers, desktops, laptops… in addition to data records such as users logging information, financial information and company’s intellectual; property…Nonetheless the physical space of the company including but not limited to the equipment room (Beal, V, 2016). As for BCP, it is intertwined with DR. while everything is taking place with DR, BCP gives the assurance that business will continue during the process of business restoration, an example of BCP would be a list of the primary functions required to keep business operation to its minimum (Techopedia, 2016). By planning developing and implementing a DR/BCP, companies will be prepared to restore its business operation and have a business continuity while the disaster recovery team is put into action by the CISO. This will prevent longs down time in the company that can cause loss in business and revenue. To underscore the seriousness of not having a DR/BCP plan, Hildebrand highlights on his article that for every minute of downtime that a company face, it has an average business cost of $5,600 for each minute of down time (Hildebrand, K, 2014, September 2).  As a continue effort to prevent a cyberattack, senior executive become to work together to develop a plan DR/BCP strategies to detect react and recover from an incident. The DR plan must include a step by step plan of action with specifics on a cyberattack incident. Finally, the BCP that can be activated as soon as a disaster is identified and will keep business flowing.

IT Service Continuity planning functions performed by staff members in the Office of the CISO

Within the office of the CISO there are lots of thinking planning and concerns. The CISO is within the senior level executive of a company, he usually will answer to the CEO and CIO. The CISO has a range of responsibilities. There is, he is responsible for develop, implement, maintain and update company’s strategy and program to give the assurance the assets of the company are protected. The CISO responsibilities is also to establish a disaster recovery program that will ensure business restoration in the case of a cyberattack, and a business continuity plan, in addition he manager staffs to recognize, create, implement and to mitigate cyberattacks. Furthermore, the CISO also directs staffs in how to respond to an incidents by the implementation of DR/BCP. The information security company Savanture in its article The Role and Functions of the CISO highlights the core responsibilities of the CISO and his staff. These responsibilities include but not limited to as follow:

1 Overall technology evaluation and selection to meet the agreed upon security architecture plan

2 Management of Security staff and Security Operations Centre (SOC)

3 Security and Business Continuity and Disaster Recovery Planning (BCDR)

4 Authentication, identity and access management

5 Perimeter, System, and Application Vulnerability Management

6 Information Technology (IT) and Business Process risk management (supply chain, financial systems, etc)

7 Computer Emergency Response Team / Computer Security Incident Response Team

8 IT investigations, digital forensics, eDiscovery

9 Communications of situational status when security events occur to corporate Public Relations (PR) (Savanture, n.d).

The office of CISO has the responsibility to be prepared to bring business back to its original format without much delay. There is why the CISO’s office and his staff are always thinking planning testing updating and concerns about a disaster on the company’s IT infrastructure. Nonetheless a minded CISO on a cyberattack will have an effective plan to mitigate the impact of a disaster resulted from a cyberattack.

Best practices for implementing disaster recovery / IT Service Continuity

The best approach to design and implement a DR/BCP is all relative to the size of the company. However there is three main principals that needs to take in consideration despite the size of the company. They are, governance, management, and technical operation. The article A Strategic Framework for IT Disaster Recovery Assessment by Dr. Julisch and Dr. Walch describes these three as essential for the implementation of DR. Governance has the focus of evaluating the extent to which executive has a clear view of the goals, police and the procedures of the organizational structures and the metrics that can guide the management to make the right decision orderly. Management follow the governance framework that is defined by senior executives. Normally the management will help in the decision of the technology to use, application, DR planning and the DR exercises. Lastly the technology, which will be assessing the operation of the IT infrastructure to whether or not is with compliance in accordance as it was projected by management (Julisch, K., & Walch, D, 2012). After these three principals are taken in consideration, the next step is to start building the DR/BCP. as mentioned, the model of the plan depends on the size of the company, so the procedure bellow is not limited to company X Y Z.

1 The computer where backups will be stored

2 The programs that company will use to back up the system

3 The backups of routers configuration

4 The backups of switches configuration

5 The backups of firewalls

6 The computers the company want to back up

7 The schedule when backups will occur

8 The offsite location where the company will archive backups

9 Have company’s software and firmware updates available.

10 Have all software disks readily available.

11 Have a plan to monitor the entire network proactively

12 Maintain hardware records.

13 Maintain software records

14 Monitor all of company’s backup jobs and ensure that they complete without any interruption.

15 Disaster recovery testing should be conducted before ever running company’s system in production. Have a plan of action to perform test, this will make sure that the company’s IT staff can recover from a disaster effectively

16 Ensure that the company’s IT staff is prepared to recover the system should the need arise

17 Practice restoring company’s Server system in a test environment to make sure that it can restore to your production environment if a disaster occur (Microsoft, 2016).

As for the BCP, have a plan in place to that can be activated without a delay if a disaster arises, this will keep the business to a minimum operation. Again a business continuity plan involves around the size of the operation of a company. A business continuity plan can be based but not limited to as follow:

1 Analysis of organizational threats

2 A list of the primary tasks required to keep the organization operations flowing

3 Easily located management contact information

4 Explanation of where personnel should go if there is a disastrous event

5 Information on data backups and organization site backup

6 Collaboration among all elements of the organization

7 Buy-in from everyone in the organization (Techopedia, 2016).

Conclusion

Cybersecurity and its dangerous has being echoing from all directions. Seniors executives (CEO, CIO and CISO) is begging to realize that even though their business have some protection, it is not enough to security company’s assets just from an outside attack and from an inside for that matter. With the realization of the cyberattacks on many company’s daily, senior executive are seeing DR/BCP as the paramount to get back up and to keep business flowing in the face of a disaster.

References

Beal, V. (2016). DRP - disaster recovery plan. Retrieved March 31, 2016, from http://www.webopedia.com/TERM/D/DRP.html

Disaster Management (Disaster Recovery Plan). (n.d.). Dictionary of Strategy: Strategic Management A-Z.

Hildebrand, K. (2014, September 2). Disaster Recovery: Multiple Solutions. Retrieved March 31, 2016, from http://www.cio.com/article/2600336/disaster-recovery/disaster-recovery-multiple-solutions.html

Microsoft. (2016). Best Practices for Disaster Recovery. Retrieved April 01, 2016, from https://msdn.microsoft.com/en-us/library/cc296756(v=bts.10).aspx

Julisch, K., & Walch, D. (2012). JOnline: A Strategic Framework for IT Disaster Recovery Assessments . Retrieved March 31, 2016, from http://www.isaca.org/Journal/archives/2012/Volume-6/Pages/JOnline-A-Strategic-Framework-for-IT-Disaster-Recovery-Assessments.aspx

Savanture. (n.d.). The Role and Function of the CISO. Retrieved March 31, 2016, from http://savanture.com/insights/the-function-of-the-ciso/

Techopedia. (2016). What is a Business Continuity Plan (BCP)? - Definition from Techopedia. Retrieved March 31, 2016, from https://www.techopedia.com/definition/3/business-continuity-plan-bcp