Upgrade to remove ads
Only $35.99/year

InfoSec Exam #3 Modules 39 - 45

Terms in this set (47)

domain address the preservation and recovery of the business in the event of outages
business continuity planning
something that interrupts the normal business process

a sudden, unplanned calamitous event that brings about general damage or loss
disaster
how to repair and restore the data center and information at the original or a new primary site
main focus of DRP
number one goal of a business continuity plan
ensure the safety of people
be prepared if a disaster were to occur

living and breathing document

constantly evolving with the organization
requirements of a BCP
should cover the entire organization
BCP scope
a strategic and operational framework to review the way an organization provides its products and services while increasing its resilience to disruption, interruption, or loss
business continuity management
1. disaster recovery
2. business recovery
3. business resumption
4. contingency plan

*all of these processes should work together in order to create a complete continuity plan
BCP management process
1. project management and initiation
2. business impact analysis
3. recovery strategy
4. plan, design, and development
5. testing, maintenance, awareness, and training

*testing and maintenance are on-going activities
phases of BCP
phase one

establish the need for BCP

obtain management support

identify strategies internal and external resources
project and management initiation
ensures that all elements of the plan are thoroughly addressed and an appropriate level of planning, preparation, and training have been accomplished

has executive level access

leader for the development team

must have the influence (title, reputation, etc.)
BCP planner/coordinator
should be the same people who would be responsible for executing the plan in the event of an outage
team members of the BCP development team
identify and develop business continuity plan phases similar to traditional project plan phases

establish BCP characteristics
project plan
how should BCP approval be documented?
in writing
functional analysis that identifies the impacts should an outage occur
business impact analysis
the longest period of time an organization can be down without losing money and having to shut down

no one wins

inly applicable to critical systems
maximum tolerable downtime
1. select interviewees
2. determine information gathering techniques
3. customize questionnaire to gather economic and operation impact information (quantitative and qualitative questions)
4. analyze information
5. determine time-critical business systems
6. determine MTD
7. prioritize critical business systems based on MTD
8. document findings and report findings
eight steps of the BIA
set of predefined and management approved actions that will be followed and implemented in response to a business interruption

*must meet MTD
recovery strategies
base it on the recovery time for mission critical business system - as outlined in BIA
recovery strategy key element
1. document all costs with each alternative
2. obtain costs estimates for any outside service
3. develop written agreements for such services
4. evaluation resumption strategies based on a full loss of the facility
5. document recovery strategies and present management for
recovery strategy development steps
1. business recovery
2. facility and supply
3. user
4. operational
5. data
categories of recovery strategies
focus is on the critical resources and the maximum tolerable downtime for each business/support unit system
business recovery
focus is on restoration and recovery
facility and supply recovery
focus is on personnel requirements
user recovery
determine the necessary equipment configures
operational recovery
a fully configured site with complete hardware and software normally provided by the client

similar systems, but not identical
hot site
similar to a hot site, although expensive equipment is not available on site - ready in a few hours (after equipment arrives)
warm site
alternate facility that does not include any technical equipment or resources except environmental support
cold site
computer-ready trailer that can be set up in a subscriber's parking lot and linked by a trailer sleeve to create a space to suit the subscriber's recovery needs
mobile site
types of agreements and arrangements between two or more companies to provide facilities to the other in the event of a disaster
reciprocal agreements
involve the capability to distribute the work requirements over two or more compatible in-house centers
multiple processing centers
off data processing services
service bureaus
expensive, identical in every respect including people ready to work on it
mirror
focus is on the recovery of information
software and data recovery
in this phase the team prepares and documents a detailed plan for recovery of critical business systems
BCP design and development
the final aspect of this phase is to combine all of the various steps into the organization's BCP
BCP document
in this phase plans for testing and maintaining the BCP are implemented and also awareness and training procedures are executed
testing, maintenance, awareness, and training
ensures that the business continuity capability remains effective, regardless of the disaster
plan testing
1. checklist
2. structured walk-through
3. simulation
4. parallel - basically an operations test
5. full interruption
five main types of BCP strategies
develop processes that maintain the currency of continuity capabilities and the BCP document in accordance with the organization's strategic direction
plan maintenance goal
1. receive and monitor input on needed revisions
2. plan maintenance reviews as needed
3. monitor changes within business units
4. control plan maintenance distribution
5. ensuring version control
plan maintenance functions
new normal in the context of the future
recovery
surviving the disaster
preservation
first step in the recovery process
damage assessment
if the time estimated to resume operation exceeds the ____________ ____________________ _______________ (_______) for critical business functions, then management should consider declaring a disaster and implementing the BCP
maximum tolerable downtime (MTD)
restoration operations involve restoring the primary site to normal operating conditions
restoration actions
1. respond
2. recover critical functions
3. recover non-critical functions
4. salvage and repair
5. return to primary site
five basic steps in the recovery process
Other sets by this creator