Business Continuity and Disaster Recovery Planning for IT Professionals, Second Edition

602 Pages·2013·5.57 MB·English

by  Susan Snedaker

Business Continuity
and Disaster Recovery
Planning for IT
Professionals
This page intentionally left blank
Business Continuity
and Disaster Recovery
Planning for IT
Professionals
Second Edition
Susan Snedaker
Chris Rima
AMSTERDAM (cid:129) BOSTON (cid:129) HEIDELBERG (cid:129) LONDON
NEW YORK (cid:129) OXFORD (cid:129) PARIS (cid:129) SAN DIEGO
SAN FRANCISCO (cid:129) SINGAPORE (cid:129) SYDNEY (cid:129) TOKYO
Syngress is an Imprint of Elsevier
AcquiringEditor:ChrisKatsaropoulos
DevelopmentEditor:BenjaminRearick
ProjectManager:MalathiSamayan
Designer:MariaIne^sCruz
SyngressisanimprintofElsevier
225WymanStreet,Waltham,MA02451,USA
Firstedition2007
#2014Elsevier,Inc.Allrightsreserved.
Nopartofthispublicationmaybereproducedortransmittedinanyformorbyanymeans,electronic
ormechanical,includingphotocopying,recording,oranyinformationstorageandretrievalsystem,
withoutpermissioninwritingfromthepublisher.Detailsonhowtoseekpermission,furtherinformation
aboutthePublisher’spermissionspoliciesandourarrangementswithorganizationssuchasthe
CopyrightClearanceCenterandtheCopyrightLicensingAgency,canbefoundatour
website:www.elsevier.com/permissions.
ThisbookandtheindividualcontributionscontainedinitareprotectedundercopyrightbythePublisher
(otherthanasmaybenotedherein).
Notices
Knowledgeandbestpracticeinthisfieldareconstantlychanging.Asnewresearchandexperiencebroaden
ourunderstanding,changesinresearchmethodsorprofessionalpractices,maybecomenecessary.
Practitionersandresearchersmustalwaysrelyontheirownexperienceandknowledgeinevaluatingand
usinganyinformationormethodsdescribedherein.Inusingsuchinformationormethodstheyshould
bemindfuloftheirownsafetyandthesafetyofothers,includingpartiesforwhomtheyhaveaprofessional
responsibility.
Tothefullestextentofthelaw,neitherthePublishernortheauthors,contributors,oreditors,assume
anyliabilityforanyinjuryand/ordamagetopersonsorpropertyasamatterofproductsliability,
negligenceorotherwise,orfromanyuseoroperationofanymethods,products,instructions,orideas
containedinthematerialherein.
LibraryofCongressCataloging-in-PublicationData
Snedaker,Susan.
BusinesscontinuityanddisasterrecoveryplanningforITprofessionals/SusanSnedaker,ChrisRima.–
2Edition.
pagescm
Includesbibliographicalreferencesandindex.
ISBN978-0-12-410526-3(pbk.)
1.Business–Dataprocessing–Securitymeasures.2.Electronicdataprocessingdepartments–Security
measures.3.Crisismanagement.4.Computernetworks–Securitymeasures.5.Managementinformation
systems–Securitymeasures.I.Rima,Chris.II.Title.
HF5548.37.S672013
658.4078–dc23
2013025237
BritishLibraryCataloguing-in-PublicationData
AcataloguerecordforthisbookisavailablefromtheBritishLibrary.
ForinformationonallSyngresspublications,visitourwebsitestore.elsevier.com/Syngress
ISBN:978-0-12-410526-3
PrintedintheUnitedStatesofAmerica
14 15 16 13 12 11 10 9 8 7 6 5 4 3 2 1
Contents
Acknowledgments..................................................................................................xix
Aboutthe Authors..................................................................................................xxi
Introduction..........................................................................................................xxiii
CHAPTER 1 Business Continuity andDisaster RecoveryOverview................1
Introduction.....................................................................................1
BusinessContinuity andDisaster RecoveryDefined....................3
Components of Business................................................................4
People inBC/DRPlanning.......................................................6
Process inBC/DR Planning......................................................8
Technology inBC/DRPlanning.............................................10
The Cost ofPlanningversus the Cost ofFailure.........................11
People......................................................................................15
Process.....................................................................................16
Technology..............................................................................17
TypesofDisasters toConsider....................................................18
BusinessContinuity andDisaster RecoveryPlanningBasics.....19
Project Initiation.....................................................................21
Risk Assessment.....................................................................22
Business Impact Analysis.......................................................22
MitigationStrategyDevelopment..........................................22
Plan Development...................................................................23
Training,Testing, and Auditing.............................................23
Plan Maintenance....................................................................23
Summary.......................................................................................24
Key Concepts................................................................................25
BC/DR Defined.......................................................................25
Components ofBusiness.........................................................26
The Cost of Planning versus the Cost of Failure...................26
Types ofDisasterstoConsider...............................................27
BC/DR Planning Basics..........................................................27
References.....................................................................................27
CHAPTER 2 Legal and RegulatoryObligations Regarding Data
andInformation Security.......................................................29
Introduction...................................................................................29
ImpactofRecent History.............................................................31
v
vi Contents
Current Regulatory Environment.................................................33
Source ofLegal Obligations...................................................33
Scope ofLegal Obligations....................................................35
InformationSecurityManagement...............................................37
Responsibility Lies at the Top................................................37
Written Information Security Program (WISP).....................38
DidYou Know?............................................................................40
Summary.......................................................................................40
Key Concepts................................................................................41
Impact of Recent History.......................................................41
CurrentRegulatory Environment...........................................41
Information Security Management.........................................41
References.....................................................................................42
Case Study
Case Study: Legal Obligations Regarding Data Security..........43
Contributor Profile........................................................................43
Background...................................................................................44
TheSonyPlayStation Incident.....................................................44
State Laws Regarding Data Security...........................................45
Noticeof Security BreachLaws............................................45
Safeguarding Personal Data State Laws................................47
Federal Laws Regarding Data Security.......................................47
U.S. House ofRepresentatives Proposed Bill........................48
U.S. Senate Response.............................................................49
Executive Order-improving Critical Infrastructure
Cyber Security........................................................................49
Conclusion....................................................................................49
References.....................................................................................50
CHAPTER 3 Project Initiation..................................................................51
Introduction...................................................................................51
Elements ofProject Success.........................................................52
Executive Support...................................................................53
User Involvement....................................................................56
Experienced Project Manager.................................................56
Clearly Defined Project Objectives........................................57
Clearly Defined Project Requirements...................................58
Clearly Defined Scope............................................................59
Shorter Schedule, Multiple Milestones..................................61
Clearly Defined Project Management Process.......................61
Contents vii
Project Plan Components.............................................................63
Project Initiationor Project Definition...................................64
Forming the Project Team......................................................71
Project Organization.....................................................................74
Project Objectives...................................................................74
Project Stakeholders...............................................................77
Project Requirements..............................................................78
Project Parameters..................................................................80
Project Infrastructure..............................................................84
Project Processes.....................................................................85
Project Communication Plan..................................................89
Project Planning............................................................................91
Work Breakdown Structure....................................................91
Critical Path............................................................................91
Project Implementation................................................................92
Managing Progress..................................................................93
Managing Change...................................................................94
Project Tracking...........................................................................94
Project Close Out..........................................................................95
Key Contributors and Responsibilities.........................................96
InformationTechnology.........................................................96
Human Resources...................................................................99
Facilities/Security...................................................................99
Finance/Legal........................................................................100
Warehouse/Inventory/Manufacturing/Research...................101
Purchasing/Logistics.............................................................102
Marketingand Sales.............................................................102
Public Relations....................................................................103
Operations.............................................................................105
Project Definition.......................................................................106
BusinessRequirements...............................................................107
Functional Requirements............................................................109
Technical Requirements.............................................................111
BusinessContinuity andDisaster RecoveryProject Plan.........112
Project Definition, Risk Assessment....................................113
Business Impact Analysis.....................................................113
Risk Mitigation Strategies....................................................114
Plan Development.................................................................114
Emergency Preparation.........................................................114
Training,Testing, Auditing..................................................114
Plan Maintenance..................................................................115
viii Contents
Summary.....................................................................................115
Key Concepts..............................................................................117
Elementsof Project Success.................................................117
ProjectPlan Components......................................................117
Key Contributors and Responsibilities.................................118
ProjectDefinition..................................................................118
BusinessContinuity andDisaster Recovery Plan................119
References...................................................................................119
IndustrySpotlight#1—Energy/Utilities
BusinessContinuity and Disaster Recovery in
Energy/Utilities..................................................................121
Introduction.................................................................................121
Integrating BC/DR Requirements into ITGovernance.............123
BC/DR Requirements Definition..........................................124
IT Service Level Definition..................................................125
Application Recovery Procedures........................................126
Summary ofIntegrating BC/DR Requirements intoIT
Governance...........................................................................127
Improving BC/DR Recoveryand Risk Mitigation Strategies...128
Ensuring Access toBC/DR Documentation ina Disaster...128
Change Approval Boardand Technical ChangeReview
Committees...........................................................................130
Security Control Testing.......................................................131
Separation of Duties.............................................................132
Centralized SecurityVulnerability Assessment...................132
IT Network Vulnerability Assessment.................................133
Security Control Baselines and Change Detection..............134
Data Center andNetwork.....................................................134
Computeand Data................................................................135
Self-service Application Failover and Failback...................139
Industrial Control Systems...................................................140
Summary ofImprovingBC/DRRecovery and Risk
Mitigation Strategies.............................................................142
Improving BC/DR Testing.........................................................143
Recovery fromActual Incidents: Postmortems and
Documenting LessonsLearned............................................143
ScheduledBC/DRTests.......................................................144
Summary ofScheduledBC/DRTesting..............................149
SummaryofBest Practices and Key Concepts.........................150
References...................................................................................150
Contents ix
CHAPTER 4 Risk Assessment................................................................151
Introduction.................................................................................151
Risk Management Basics...........................................................153
Risk Management Process....................................................155
People, Process, Technology, and Infrastructure in Risk
Management................................................................................159
People....................................................................................159
Process...................................................................................160
Technology............................................................................160
Infrastructure.........................................................................161
IT-Specific Risk Management....................................................161
ITRisk Management Objectives..........................................162
The System DevelopmentLifecycleModel.........................163
Risk Assessment Components....................................................166
InformationGatheringMethods...........................................168
Natural andEnvironmentalThreats.....................................169
Human Threats......................................................................185
Infrastructure Threats............................................................195
Threat Checklist....................................................................199
ThreatAssessment Methodology...............................................202
QuantitativeThreat Assessment...........................................203
QualitativeThreat Assessment.............................................207
Vulnerability Assessment...........................................................211
People, Process,Technology, andInfrastructure.................214
Vulnerability Assessment.....................................................216
Summary.....................................................................................219
Key Concepts..............................................................................221
Risk Management Basics......................................................221
Risk Assessment Components..............................................222
Threat Assessment Methodology.........................................222
Vulnerability Assessment.....................................................223
References...................................................................................223
CHAPTER 5 Business Impact Analysis...................................................225
Introduction.................................................................................225
BusinessImpact Analysis Overview..........................................226
Upstream and Downstream Losses......................................229
Understanding TheHumanImpact......................................230
Understanding Impact Criticality...............................................232
CriticalityCategories............................................................232
Recovery TimeRequirements..............................................235