Robert J. Fischer, ... David C. Walters, in
Introduction to Security (Tenth Edition), 2019 Within this chapter, the authors have attempted to provide the reader with a framework for understanding the complexities of
contingency planning and the development of contingency plans. A particular point we attempt to make lies with the importance of planning for categories of contingencies. It is a daunting task to attempt to plan for each and every possible contingency. However, contingencies can be grouped into categories and planned for accordingly. This allows for consistency in preparedness and best utilization of resources. Types of contingencies develop and change over time as societies and
organizations change and progress. Prior to the 20th century, nuclear contamination was not a concern, but today countries with nuclear power generation capabilities have in place extensive contingency plans that are regularly tested. More common hazards such as severe weather and other natural events have caused enough damage to drive organizations to better preparedness. State and local governments along with private enterprises in states like California and Mississippi spend large sums of
money to prepare to mitigate the effects of earthquakes and flooding. Contingency planning may not have been a traditional security process, but in today’s global business environment the security organization is assuming a much greater role and responsibility for its implementation. Even prior to the events of September 11, 2001, many organizations were becoming more conscious of the need to have contingency plans. A complete contingency planning program has three major elements: Emergency response Crisis management Business continuity: business recovery and business resumption Emergency response activities involve responding to an incident, crisis, or disaster and managing that incident at the scene. Should an incident escalate to the crisis or disaster stage, a CMT should take
over managing the crisis to its conclusion. If the crisis or disaster does cause damage to a company building, facility, or operation, the CMT should hand over to a business continuity team the responsibility of recovery and resumption. After a disaster, it is critical that the business recovers and resumes normal (preevent) operations as soon as possible. Customers, shareholders, and stakeholders expect nothing less. Executive management has the obligation to ensure contingency planning is
properly considered and addressed within their company. The consequences of not planning for contingencies can be catastrophic, with numerous liability issues Critical Thinking Can a business be successful without having contingency plans? Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780128053102000111 Response
Mary Lynn Garcia CPP, in Design and Evaluation of Physical Protection Systems (Second Edition), 2008 Security PrinciplesContingency planning forms the basis of an effective response force. This includes corporate policies and procedures, training, determination of response force tactics, use of force, and normal operating procedures. Response to a malevolent event can be immediate, requiring a response force capable of timely response, or after-the-fact recovery, which is accomplished through a greater range of activities. Response force strategies include containment, denial, and assault. A vital element of response force effectiveness is communication. The measures of response force effectiveness include response force time for interruption and probability of communication. The probability of neutralization can be used at sites where an immediate response is present and guards are expected to engage with the adversary. Interruption describes arrival of the response force at the appropriate location. It is assumed that for most industrial facilities, arrival will cause the adversary to surrender or abandon the intrusion. For high-security sites, neutralization, or defeat of the adversary after interruption, is another aspect of response force effectiveness. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780080554280500166 Contingency Planning*Dr.Gerald L. Kovacich, Edward P. Halibozek, in Handbook of Loss Prevention and Crime Prevention (Fifth Edition), 2012 Contingency Planning ProgramThe purpose of contingency planning is to better enable IWC to maintain continuity of the business. Should disruptions occur, and they do all too often, IWC must be able to resume normal business activities as quickly as possible. The inability to restore normal operations will have an adverse economic impact on IWC. The extent of the impact will correspond to the extent of the disruption or damage. If the damage is severe and the mitigation of such damage has not been properly planned for, the effect could be catastrophic. Essentially, the business could fail. Having an IWC policy on contingency planning is the basis for a sound and functional program. It is also an integral part of the IWC CAPP. Contingency planning is generally not considered part of the normal daily operation for most employees, departments, or organizations. Therefore, it is not automatically or even normally addressed. Employees and management tend to focus on the priorities of their specific jobs and departments. Seldom do they consider the potential effects of a contingency occurrence. Contingency planning for most at IWC is not perceived to be part of their job. A contingency planning program is required by IWC policy, and specific responsibilities are identified and assigned. Ultimately, to become completely effective, contingency planning must become part of IWC’s business and company culture. Contingency planning is a continuous process. It is not something that can be done once and put away, only to be retrieved when needed. It is a continuous process requiring periodic updates and revisions as appropriate to, and consistent with, changing IWC business conditions. It also involves implementing and maintaining an awareness or training element. The process of contingency planning at IWC is focused to achieve the following: •Secure and protect people: In the event of a crisis, people must be protected. •Secure the continuity of the core elements of the business: The infrastructure and critical processes — minimize disruptions to the business. •Secure all information systems: These include or affect supplier connections and customer relationships. Throughout the remaining sections of this chapter, elements of the contingency planning process and program (Figure 41-2) will be presented and explained. Examples of different situations, as encountered at IWC or by the IWC CSM will be used to illustrate impact and response.2  Figure 41-2. Elements of a business continuity planning program. Contingency Planning and ManagementContingency plans formally establish the processes and procedures to protect employees, core business elements, information systems, and the environment in the event of an emergency, business disruption, or disaster. These IWC plans, also incorporated into the CAPP, discuss specific types of emergencies and disasters and address the mitigation, preparedness, and response actions to be taken by IWC employees, management, and the organizations charged with specific response and recovery tasks. These plans contain basic guidance, direction, responsibilities, and administrative information. The CSM’s project team concluded that plans must also be developed, maintained, and shared with management and employees in writing (hardcopy and/or electronic). It was also determined that in the United States, this is a standard requirement of Occupational Safety and Health Administration (OSHA). The project team decided that to develop contingency plans, the preparedness process must include the following considerations and elements: •Assumptions: Basic assumptions need to be developed in order to establish contingency planning ground rules. It is best to use as a baseline for planning several possible “worst-case” scenarios relative to time of event, type of event, available resources, building occupancy, evacuation of personnel, personnel stranded on site, and environmental factors such as weather conditions and temperature. Furthermore, consideration should be given to establishing response parameters for emergency events. Define what constitutes a minor emergency, a major emergency, and a disaster. •Risk assessment and vulnerability analysis: An IWC crisis management team was recommended by the project team and subsequently formed and assigned the responsibility to identify known and apparent vulnerabilities and risks associated with the type of business and geographical location of the enterprise. An assessment of risk and vulnerabilities would be made prior to upgrading contingency plans. All planning would be accomplished in accordance with a thorough understanding of actual and potential risks and vulnerabilities. For example, IWC has one office building that is very old and constructed completely of wood and other combustible materials; therefore, it is vulnerable to fire. That same building happens to be located in an arid geographical area where there is a high risk of fire; consequently, planning needs to be done to address the hazard of fire. Here the likelihood of fire is high and the vulnerability to fire is high. Therefore, the risk of potential damage is high. Conversely, another IWC office building is vulnerable to the effects of an earthquake; however, it is located in a geographical region that has no history of earthquakes or evidence of any geological probability of an earthquake occurrence. Therefore, the risk to the building is low. In this case, planning for an earthquake would be a waste of resources. The project team’s risk assessment and vulnerability analysis also included an assessment of the policies and practices of IWC’s critical relationships. That meant involving suppliers and customers in the contingency planning process. Regardless of how prepared IWC may be, if a critical supplier or many key suppliers are not also prepared for various potential contingencies, their inability to recover will adversely impact IWC. Therefore, critical suppliers will be integrated into the contingency planning process. •Types of hazards: Planning for each and every type of hazard is not practical or desirable. Grouping hazards into similar or like categories will allow for planning to address categories of hazards. Since many hazards have similar consequences and result in like damages, it is best to plan for them in categories. Medical emergencies, fires, bomb threats, high winds, power interruptions, floods, hurricanes, snow/ice and storms/blizzards, hazard materials issues, aircraft crashes, civil disorders, earthquakes, terrorist threats/activities, workplace violence, explosions, and tornados are all common hazards IWC may face. •Critical process identification: The project team also decided that all critical processes must be identified. These processes must be ranked according to criticalness and importance to the productivity and survivability of the enterprise. The process of recovery would be focused on those critical processes that, when resumed, will restore operations to a minimal acceptable level. In essence, these processes are identified to be the first processes restored in the event of a major interruption to business operations. Failure to restore them presents the greatest possibility of damage or loss, including possible loss of IWC’s competitive edge and market share. •Business impact analysis: A business impact analysis must be accomplished to accurately determine the financial and operational impact that could result from an interruption to the IWC business processes. Moreover, all critical interdependencies, those processes or activities that critical processes are dependent on, must be assessed to determine the extent to which they must be part of the contingency planning process. •Emergency response: Establishing precisely who will respond to emergencies, and what response capabilities are needed, was considered by the project team to be essential. All participants in the emergency response process must understand what is expected of them. These expectations must be well defined and documented. Guidance for all employees on how to react in the event of an emergency and what their individual and collective responsibilities are must be documented and distributed. Organizational responsibilities must also be established to include the development of department-level emergency plans. Events such as building evacuation and roll-call assembly need to be well defined so that in the event of an actual emergency, there is no confusion or uncertainty as to what must be accomplished. Incident management and crisis management: The project team determined that as an incident escalates, the crisis management team should assume the responsibility of managing the crisis. How this process works and who has what responsibilities must be clearly stated in the contingency plans. In the event of an actual emergency, there will be people who will attempt to manage the incident or participate in crisis management; however, they should not have a role in this process unless they were previously identified and trained as part of the crisis management team. Without established and well-defined incident management protocols and procedures, chaos is likely to occur. •Incident/event analysis: When an emergency incident or event occurs, interrupting or disrupting the IWC business process, the IWC security department personnel will be charged with responding to and managing the scene. They will also be responsible for conducting an incident/event analysis. This analysis will be conducted to determine the immediate extent of damage and the potential for subsequent additional damage. The appropriate resources must be notified and activated to assist in damage mitigation. •Business resumption planning: The project team decided that the process of planning to facilitate the recovery of designated critical processes and the resumption of business in the event of an interruption to the business process must be performed in two parts. The first part focuses on business recovery in the short term, while the other part focuses on business restoration in the long term. This process will also include establishment of priorities for restoration of critical processes, infrastructure, and information systems. •Post event evaluation: An assessment of preceding events to determine what went well, what went different than planned, and what improvements to existing plans should be made is also part of the process. Real events can present an opportunity to learn. There is no better way to learn how to handle an emergency than to actually handle one. Unfortunately, experiencing an emergency may cause damage to IWC. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780123852465000419 Developing the Contingency PlanLaura Taylor, Matthew Shepherd Technical Editor, in FISMA Certification and Accreditation Handbook, 2007 Roles and ResponsibilitiesThe Contingency Plan should establish roles and responsibilities designed to recover operations. Depending on the outage or disaster that has occurred, the recovery operations ostensibly could be at the original facility, or at an alternate facility. Because there are so many different recovery scenarios, you'll want to have the roles and responsibilities defined in general terms so that they can be applied to as many different types of situations as possible. Depending on the size of your organization or department, some of your staff may provide support for more than one role. Typically, the roles of the recovery team are additional roles to a staff member's regular and ordinary duties. For example, the ISSO may act as the Contingency Planning Coordinator and an IT manager may act as the Information Systems Operations Coordinator. It is also conceivable that two people could act as a team in assuming the responsibilities of a particular role. For example, the Damage Assessment Coordinator has such an extensive list of duties that it might make sense to assign two people to this role. The names of the particular staff who will be assuming each role should be documented. An example of how to document these roles is depicted in Table 16.2. Table 16.2. Recovery Roles Noted
Roles, and the associated responsibilities of the recovery team, that seem to work well for many Contingency Plans are included in the sections that follow. However you should not limit your Contingency Plan to what is documented in these sections. Your plan may require additional or altogether different roles depending on your operations and your business mission. Contingency Planning CoordinatorThe Contingency Planning Coordinator has the following responsibilities: ▪Establishes personnel rosters and maintains staff location information ▪Evaluates supporting information for accuracy and correctness ▪Ensures that supporting information is consistent with requirements ▪Receives status reports from recovery staff ▪Prepares and keeps current recovery team status reports ▪Keeps the staff at remote locations advised of the situations ▪Advises the Logistics Coordinator on new equipment that should be ordered ▪Identifies and coordinates alternate processing location and requirements ▪Coordinates annual testing of the Contingency Plan Damage Assessment CoordinatorThe Damage Assessment Coordinator has the following responsibilities: ▪Assesses damage to the assets ▪Determines the cause of the disruption ▪Determines the level of the disruption ▪Determines if key personnel have been lost or have perished ▪Determines if there has been a violation of classified information ▪Determines assets requiring replacement ▪Determines if personnel are in danger ▪Makes recommendations on whether or not to relocate to an alternate site ▪Estimates the recovery time ▪Estimates level of backup personnel required ▪Contacts outside service organizations for additional support (if necessary) ▪Ensures the security of the primary (original) site ▪Alerts vendors of the situations and requests their assistance as necessary ▪Makes recommendation on whether to relocate to alternate site ▪Briefs team members on recovery duties and responsibilities ▪Reports status and recommendations back to the Contingency Planning Coordinator Emergency Relocation Site Adviser and CoordinatorThe Emergency Relocation Site Adviser and Coordinator has the following responsibilities: ▪Notifies team leaders of relocation arrangements and plans ▪Ensures that all backup media is transported to the alternate site ▪Coordinates transportation of employees to alternate site ▪Ensures complete restoration of resources upon return to primary site ▪Reports status and recommendations to back the Contingency Planning Coordinator Information Systems Operations CoordinatorThe Information Systems Operations Coordinator (ISOC) has the following responsibilities: ▪Assists in testing of applications prior to putting into production at alternate site ▪Initiates restoration of services ▪Provides technical support to recovery staff as need ▪Overseas operations between primary site and alternate site ▪Reports status and recommendations to back the Contingency Planning Coordinator Logistics CoordinatorThe Logistics Coordinator has the following responsibilities: ▪Initiates standby procurement actions ▪Coordinates the delivery of equipment, supplies, parts, and software ▪Expedites the acquisition of supplies and equipment ▪Maintains communications with vendors providing equipment ▪Documents estimated delivery times for new equipment ▪Retains copies of all service level agreements and provides them to team ▪Retains any encryption keys that are escrowed ▪Reports status and recommendations back to the Contingency Planning Coordinator Security CoordinatorThe Security Coordinator has the following responsibilities: ▪Ensures that security safeguards are restored to primary site after reconstitution ▪Ensures the security of the secondary (alternate) site ▪Ensures that only approved personnel have access to alternate facility ▪Maintains list of all approved personnel who have access to facilities ▪Reports status and recommendations to back the Contingency Planning Coordinator ▪Ensures that all encryption keys are properly restored and recovered ▪Maintains a checklist of security configuration restoration activity ▪Verifies that security safeguards are in place before bringing alternate site into production Telecommunications CoordinatorThe Telecommunications Coordinator has the following responsibilities: ▪Initiates alternate communications arrangements ▪Coordinates the need for new telecomm equipment with the Logistics Coordinator ▪Expedites the acquisitions of communications facilities and services ▪Supervises all telecomm installations and configurations ▪Overseas access to telecomm wiring closets ▪Works with ISOC to restore connectivity between systems and networks ▪Oversees testing of alternate communications ▪Reports status and recommendations to back the Contingency Planning Coordinator In some cases, an organization may have a separate team whose soul responsibility is to return the primary site back to operational status. This team usually is referred to as the Reconstitution Team. While operations is on-going at the alternate site, the Reconstitution Team works at the primary site cleaning up, repairing equipment, and preparing everything to return to normal operations so that a clean cut-over back to the original site can be made. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597491167500214 Holistic Security Through the Application of Integrated TechnologyRobert J. Fischer, ... David C. Walters, in Introduction to Security (Tenth Edition), 2019 Hardware BackupMost people think contingency planning and hardware backup are the same thing. This is not the case. Hardware backup is only one element of contingency planning. In this phase, classifying possible disruptions is useful so that hardware backup strategies can be developed. There are three categories of disruptions: nondisasters, disasters, and catastrophes. Nondisaster disruptions are normally system malfunctions or other failures. Disasters cause the entire facility to be inoperative for longer than 1 day. Catastrophes entail the destruction of the data-processing facility. In this last category, a new facility must be built or an existing alternate structure must be identified to be used as the computer center. Once the extent of the disruption is ascertained, the company must make arrangements for alternate locations in which to conduct their computer operations. Alternative locations are categorized into hot, warm, and cold sites. Hot sites are fully configured and ready to operate within several hours. Warm sites are partially configured but are missing the central computer. Because the central computer is missing, these sites are less expensive than hot sites. However, it may take several days or weeks to locate and install the main computer and any other missing equipment necessary for operation. Once the equipment is installed, these sites can be operational within several hours. The least expensive sites are referred to as cold sites. These locations are ready to receive equipment but do not have any components installed in advance. Cold sites take at least several weeks to become operational. The major factors in choosing the right “temperature” of the three types of sites are the company’s needs in terms of activation time and cost. All companies must also have a way of alerting personnel of a disruption and telling employees which site to report to for work. Computer personnel must also be trained to operate the hardware at the new site. Finally, the hardware must be compatible with the equipment damaged or destroyed. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780128053102000172 National Security Affairs ReportingJohn J. Schulz, in Encyclopedia of International Media and Communications, 2003 I.B.3 Military Missions and Goals: A Second Conflict of CulturesMilitary officers in peacetime are tasked with contingency planning to be ready to fight the next war and to anticipate other threats. To do this, they must be advocates for government funding needed to research and develop—or purchase from elsewhere—the best and most technologically advanced weapons while simultaneously recruiting and training military manpower. In addition, since the 1970s, for the United States and the other most modern armed forces, defense and national security has increasingly involved computers, satellites, and a vast array of other scientific and technological equipment as much or more than it involved ships, aircraft, or troops with rifles. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B0123876702001898 Business Continuity and Disaster Recovery OverviewSusan Snedaker, Chris Rima, in Business Continuity and Disaster Recovery Planning for IT Professionals (Second Edition), 2014 Business continuity and disaster recovery planning basicsYour role as an IT professional is unique in BC/DR because on one hand, you are not necessarily responsible for the company’s comprehensive BC/DR planning, but on the other hand, technology is so integral to most corporate operations, IT can’t be completely separated out as a stand-alone issue. As a result, we will continually address BC/DR in a holistic manner and allow you to determine the most appropriate role for your IT group within your company. The elements that should be included in your plan will extend beyond the walls of the IT department, so you’ll need to form a project team with expertise in several areas. Figure 1.4 shows some of the areas that might be included, depending on the type of products and services your company creates. Figure 1.4. Subject matter expertise needed for BC/DR planning. You’re no doubt familiar with the concept of reliable system design and single point of failure when it comes to designing, implementing, managing, and repairing the IT infrastructure for your company. Briefly, these concepts relate to building in redundancies and safeguards so that if one key component fails, the entire company doesn’t come to a screeching halt. You probably also understand that having two servers or routers in the same rack leaves your network vulnerable—the single point of failure could be as simple as someone tripping and spilling a large cup of coffee on the rack itself (granted, they have no business bringing coffee into the data center, but that’s another issue that goes back to how much data loss is caused by humans…). You might conscientiously make backups, verify the backups, and store them securely but leave them on-site. The single point of failure could be as minor as something falling on the rack holding your tape backups or as major as a serious fire in the server room or building. The reason for discussing this concept at this juncture is that as you look at your BC/DR options, you need to assess your risks with regard to reliable systems and single points of failure. For example, you may want to evaluate your availability solutions as part of an overall business strategy to reduce operational risks, minimize the occurrence and cost of downtime, and maximize data and IT service availability. These availability solutions will also likely impact your compliance with a variety of regulations by providing protection and reliability of information resources as well. Additionally, these solutions will impact your BC/DR risk assessment and planning. If these solutions are not currently in place, this BC/DR planning process may help you build the business case for implementing some of these technologies. If they are currently in place, you can look at them with a fresh perspective to determine how they contribute to an overall business continuity strategy. We’ll discuss this in more detail in Chapter 4. With that, let’s look at contingency planning basics: the steps to be taken to create a solid BC/DR plan for your company. The basic steps in any BC/DR plan, shown in Figure 1.5, include: Figure 1.5. Basic business continuity and disaster recovery planning steps. •Project initiation •Risk assessment •Business impact analysis •Mitigation strategy development •Plan development •Training, testing, and auditing •Plan maintenance Those of you familiar with project management (PM) methodologies will notice the similarity in the BC/DR planning process to PM processes and with good reason. Creating a BC/DR plan can (and should) be approached as a discrete project that has a defined start, middle, and end. As with many other IT projects, once the BC/DR plan is completed, it must be maintained so that it stays current with changes in the company, its technology, and the broader business landscape. We’ll discuss each of the sections here briefly to provide an overview, and we’ll delve more deeply into each of these areas in subsequent chapters. Project initiationProject initiation is one of the most important elements in BC/DR planning because without full organizational support, the plan will be incomplete. As an IT professional, there may be limits to what you can do to create an organization-wide functional BC/DR plan. For example, you may know how to set permissions for a particular business application, but do you really know how users interact with it and what would be required to get the business back up and running with regard to that particular business function? If the application server is destroyed and you have data backups, do you also have a way to access those backups? Do you have a way to allow users to connect to the application securely? Where are users located? How will business resume? Can it resume without that application in the near term or not? You will not likely be able to answer these questions. It requires the input and assessment from subject matter experts in other departments and divisions. Therefore, getting executive and company-wide support for the BC/DR planning process is absolutely key to its success. We’ll discuss this in more detail in Chapter 3. Risk assessmentRisk assessment is the process of sitting down with key members of your company and looking at the potential risks your company faces. These risks run from ordinary to extraordinary—from a fire or minor flood in a server room to a catastrophic loss such as an earthquake or major hurricane and everything in between. You can refer to Appendix A for a list of the most common types of threats as a starting point (also see Chapters 4 and 5). Again, as an IT professional, you can certainly lend your expertise to this process by helping define the likely impact to technology components in various types of disasters or events, but you can’t do it alone. For example, it’s likely that your transportation manager understands the potential business impact of bad weather around the country, not just in your local area. Your marketing manager might best understand the potential business risk of a contaminated product or a Web site breach. Some of these areas may fall into pure BCP and may be more suitable for others in your organization. However, in almost all companies, IT expertise must be included in the BC/DR risk assessment process. In Chapter 4, we’ll discuss risk assessment in depth. Business impact analysisIn a sense, this is where “the rubber meets the road.” Once you’ve delineated your risks, you need to turn your attention to the potential impact of these various risks. This is one area that, as an IT professional, you clearly need input from your company’s experts. As mentioned earlier, you might understand the technical aspects of an application server going down, but what is the actual business impact and can that be tolerated? For example, you might determine that your Enterprise Resource Planning or your Electronic Medical Record application cannot be down. Period. E-mail, Web servers, and reporting tools, however, can go down, even though both events would be disruptive. Once you understand these parameters, you can develop an IT-based strategy to meet the requirements that result from this analysis. We’ll look at business impact analysis and how IT interacts with this process in Chapter 5. Mitigation strategy developmentIf you’re part of a small company, your mitigation strategy might be quite simple. Keep critical data backed up to a secure cloud location, keep several copies of backups off-site, and keep several copies of key information such as employee list, phone numbers, emergency service phone numbers, key suppliers, and customers in a binder off-site in a secure but accessible location. That might be the extent to which you choose to mitigate your risks. However, for most companies, the process is a bit more complex. For each identified risk that has a significant business impact, you need to look at your options. How can the risk and impact be tolerated, reduced, avoided, or transferred? We’ll discuss mitigation strategies in Chapter 6. Plan developmentAfter you’ve gone through the analysis steps, you’ll be ready to develop your plan. As with other types of IT project plans, you’ll want to outline the methodology you’re going to follow so that you improve your chance of success and reduce your chances for errors and gaps. This includes standard processes such as developing business and technical requirements, defining scope, budget, timeline, quality metrics, and so forth. We’ll discuss these elements in Chapter 7, and we’ll use standard IT PM methodologies to help you create a solid plan, regardless of the size of your company. Training, testing, and auditingOnce the plan has been developed, people need to be trained on how to implement it. In many cases, scenario-based case studies can be a good first step (though this may be part of the plan development stage as well). Running through appropriate drills, exercises, and simulations can be of great help, especially for disasters or events that rank high on the list of “likely to occur.” In Chapter 8, we’ll discuss emergency preparations. Then, in Chapter 9, we’ll look at some of the ways you can train, test, and audit your plan so that you can develop a process that closely tracks with your company and the way it operates. Plan maintenanceFinally, plan maintenance is the last step in the BC/DR planning process, and in many companies, it is “last and least.” Without a plan to maintain your plan, it will become just another project document on a file server or sitting in a binder on a shelf. If it doesn’t get maintained, updated, and revalidated from time to time, you’ll find that the plan may be rendered useless if a disaster does strike. Maintenance doesn’t have to be an enormous task, but it is one that must be done. Most importantly, there must be an organizational commitment to do so and someone within the company to own it. We’ll look at this in Chapter 10 and provide some tips on how to incorporate these tasks into your day-to-day operations to reduce the ongoing burden of plan maintenance. Looking Ahead…IT, Security, Disasters…and the LawOne of the strong trends in IT and IT security is the increased demand that companies secure private data such as social security numbers, credit card numbers, home addresses and phone numbers, financial data, medical data, and more. As the amount of electronic data collected and stored increases, so too does the risk to individuals. Recent headlines are rife with examples of personal data being lost, stolen, hacked, or modified. Companies can no longer say “we did our best” without proving that their best was at least up to current industry standards. Looking ahead, companies can expect three major trends to impact how they manage IT security. These standards will apply during normal business operations and emergencies—companies won’t be able to easily blame breaches and theft on emergencies that were foreseeable and manageable, as is the case with many of the disaster events listed earlier in this chapter. These three key trends, which you should monitor for your IT organization, are: •The continuing expansion of the requirement to provide IT (and data) security •The emergence of a standard definition of “reasonable security” •The imposition of the duty to notify after a security breach Consumers and regulators alike are raising their expectations regarding IT security, and companies are both legally and ethically bound to make serious, effective efforts to safeguard private data. Emergency and disaster conditions may soften those requirements just a bit but don’t assume your company will be able to hide behind a disaster or event if data are lost, stolen, mishandled, or inappropriately disclosed. If your firm deals with data that are sensitive, confidential, or private in nature, consult with your firm’s legal counsel to understand fully the legal and regulatory requirements your firm will be subject to during a crisis, emergency, or disaster. In Chapter 2 and the case study that follows it, we provide examples of the need for due diligence in handling electronic data regardless of whether you’re facing normal operational challenges or a major disaster. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9780124105263000015 Mitigating Impact From Natural Disasters, Building Resilience in Tourism: The Case of KeralaSimona Azzali, ... Jacob Wood, in Economic Effects of Natural Disasters, 2021 8.7 Challenges FacedThe 2018 and 2019 Kerala floods highlighted challenges in key institutional coordination, policy guidelines, contingency planning, disaster risk management programs, public infrastructure services, financing programs, and data collection. The floods highlighted a number of structural constraints that left Kerala unprepared for major natural disasters. This included inadequate policies and institutional frameworks to manage and monitor critical natural resources such as water and land. There is also the absence of risk-informed spatial and sectoral planning policies and frameworks that led to extensive urban sprawl, unmanaged construction in hazard-prone areas. Another challenge faced at the time of the disaster was the lack of disaster risk preparedness in key socioeconomic sectors and weak capacity of institutions and individuals to anticipate and respond to extreme events. More importantly, there is a lack of availability and sharing of reliable data for disaster risk planning and management due to inadequate hydromet system, and limited fiscal resources and financing modalities for risk pooling and sharing (RKDP, 2019). Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B978012817465400008X Incident Response – Putting Out Fires Without Getting BurnedAaron W. Bayles, ... Johnny Long, in Infosec Career Hacking, 2005 Links to Sites▪ http://csrc.nist.gov/publications/nistpubs/800-34/sp800-34.pdf - NIST guide to CP ▪http://bestpractical.com/rtir/ - RT for IR database product ▪www.snort.org - Snort IDS ▪http://secureideas.sf.net/ - BASE Snort database engine and tracking software ▪http://sguil.sf.net, SGUIL Snort front-end ▪www.opensims.org - OpenSIMS Snort front-end ▪www.bleedingsnort.com, Cutting-edge Snort rulesets ▪https://engineering.purdue.edu/ECN/Resources/Documents/UNIX/evtsys - Event Log to Syslog generator ▪www.amanda.org - AMANDA backup solution ▪www.tripwire.com - Tripwire file integrity checker ▪http://aide.sf.net - AIDE file integrity checker ▪http://la-samhna.de/samhain/ - Samhain file integrity checker ▪www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/tools.html - Checking for security flaws in software overview ▪www.dwheeler.com/flawfinder - Flawfinder is designed to check C/C++ code for common issues. ▪www.securesw.com/rats - RATS provides some of the same functionality as Flawfinder ▪http://bfbtester.sourceforge.net/ - BFBTester will do input validation checking against compiled binaries. ▪www.immunitysec.com/spike.html - SPIKE is designed for testing network capable applications ▪www.nessus.org - Nessus open-source vulnerability scanner ▪https://vsc-dev.itsp.purdue.edu/about.php - Purdue University Nessus Vulnerability Scanning Cluster software for tracking remediation ▪www.sleuthkit.org - Sleuth Kit forensics toolkit ▪www.porcupine.org/forensics/tct.html TCT for forensic analysis ▪www.cacti.net - Cacti network trending software ▪http://people.ee.ethz.ch/∼oetiker/webtools/mrtg/ - MRTG for network trending and graphing ▪http://ntop.ethereal.com/ntop.html - Ntop; network trending and protocol graphing ▪www.tcpdump.org - Tcpdump; everyone's favorite network analysis tooln www.packetfactory.net/projects/ngrep/ - ngrep allows you grep through network traffic ▪www.netstumbler.com - NetStumbler; Windows-based wireless network detection software ▪www.kismetwireless.net. Kismet; wireless detection and tracking software. ▪www.sonar-security.com/sv.html - StumbVerter; generates maps from GPS tracks and NetStumbler ▪www.channelregister.co.uk/2005/04/07/hard_drive_with_police_info_sold_on_ebay/ - Story on data remaining on sold police hard drive ▪www.thc.org/download.php?t=r&f=secure_delete-3.1.tar.gz - THC's Secure Delete program for erasing datan http://dban.sf.net - DBAN bootable forensic wipe CD. ▪http://money.cnn.com/2005/03/17/pf/jumpstart1_0504/index.htm - CNN story on jumpstarting your career. ▪www.worldwidewardrive.org/ - WorldWide WarDrive site ▪www.acm.org/ - ACM main Website ▪http://dc.securitygeeks.com/about.html - DC Security Geeks Web site, local security group Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B9781597490115500179 Internal ControlGlynis D. Morris BA, FCA, ProfessorPatrick Dunne BSc, MBA, in Non-Executive Director's Handbook (Second Edition), 2008 Publisher SummaryInternal control is one of the main elements in the management of risk, along with the transfer of risk to third parties, the sharing of risk, and contingency planning. The risks that any entity faces will inevitably change as the business develops and the environment in which it operates evolves. Companies must therefore regularly review and evaluate the risks to which they are exposed. The aim will usually be to manage and control business risk rather than to attempt to eliminate it completely. The Turnbull guidance is based on the principle that companies will adopt a risk-based approach to establishing of a system of internal control and to the regular review of its effectiveness. The review of the effectiveness of the internal control system should therefore be part of the normal process of managing the business rather than a specific exercise carried out only in order to comply with the recommendations of the Combined Code. A system of internal control can never provide absolute protection against business failure, material error, fraud or breaches of regulations, but it should be able to provide reasonable assurance against these problems. Read full chapter URL: https://www.sciencedirect.com/science/article/pii/B978075068419450019X What is the first step in disaster recovery and contingency planning?Your first step should be to establish which disasters to plan for. As part of your risk assessment phase, you should have put together a group of some of the top managers at your client's organization to determine how quickly each department needs its systems up and running after an interruption.
Which is the first step in the contingency planning process?To develop a contingency plan, first conduct a risk assessment: identify your business-critical operations, identify the threats to those operations, and analyze the potential impact of each threat.
What are the 5 steps of contingency planning?The following are the five basic steps of contingency planning for epidemic, pandemic, or other emergency situations.. Program Management. ... . Planning. ... . Implementation. ... . Testing & Exercise. ... . Program Improvement.. Which one of the following should be considered most critical to a disaster recovery plan?Standardized communication
One of the most critical components of a disaster recovery plan is an up-to-date communication strategy.
|
Which of the following is a critical first step in disaster recovery and contingency planning?
zusammenhängende Posts
Urheberrechte © © 2024 toptenid.com Inc.
