Business continuity and disaster recovery

Editor's Notes

• #2: This covers most of the CISA Chapter on Business Continuity and Disaster Recovery.
• #4: Different companies will react in different ways to problems. A bank may want to bring down a network as fast as possible if an intruder penetrates their network. A pharmacy may want to leave their network up as much as possible but doublecheck integrity – or decide to bring down a partial network.
• #8: This shows a lot of vocabulary in pictorial form. The alternate mode is not a full service mode.
• #10: It is a good idea to classify business processes. Upper management should do this.
• #11: We may decide that the Sales function is most critical (or perhaps not), and so Sales is number 1. If we don’t have sales, we don’t ship. Engineers can work at home on their projects. While their work is critical to backup, if they lose a week, it may mean ½ week lost productivity, resulting in lost salary. Within Sales, the web service is 50% of sales, and cannot be done manually, so it is rated number 1. The Sales calls can be done manually at home or most of our sales people are on the road anyway.
• #12: A note here is that sometimes the RTO varies by day of year (scheduling system for a school is most important the week before and first week of school.) Also, management and people involved with a database may disagree, in which case management sees the larger picture, and their opinion is most important. However a risk manager may consider both perspectives.
• #13: The interruption (red thing) is far to the right. If we want a short RPO, then RAID or disk mirroring is the best option. Otherwise we may want to save off a disk image. A slower recovery would involve tape.
• #15: RAID 1 and above use redundancy, offering survival if a single disk fails.
• #16: With redundancy, if one part fails, another part can take over. Diverse Routing means one provider, but multiple routes (or paths). Alternate Routing means multiple network providers, and/or multiple mediums (fiber, cable, radio) Long-haul = Long Distance Last-mile circuit = from office (or home) to service provider (local telco or cable company)
• #17: There is a curve showing the cost of having a system down, and another curve showing the cost of bringing an alternative system up quickly. The least cost is the cross-point of these two curves.
• #18: Hot, warm, cold, and mobile sites can be rented from special companies. Contracts must be carefully looked over. A duplicate info processing facility can be a computer system in another division of the company.
• #19: Definition: Cloud Computing: A shared pool of configurable computing resources (such as Servers, Applications, Databases, Services, Computers) that can be rapidly customized and released with minimal management effort or service provider. Any user within the network is allow access to the shred configurable resource by providing authentication. Once authentication is approved, user is allowed to customize resource. Advantages: Cost Since the cloud provider supplies the organization’s infrastructure, cloud computing becomes an operational cost rather than a capital cost. Also cost is reduced by reducing technical staff and centralizing computing resources Scalability Reduces or eliminates physical space for storing data Reliability Large cloud computing providers have redundant sites for users, which may address business continuity and disaster recovery risk Performance Provider continuous and consistent monitoring Agility Rapidly providing infrastructure resources Disadvantage: Potential for High Risk/Security Concerns Since cloud computing is new technology, there maybe unknown bugs or holes Technical Support is not familiar dealing with arising problems Solutions may take longer to solve Source:  CISM® Review Manual 2012 , © 2011, ISACA. All rights reserved. Used by permission.
• #21: Some things to consider: Infrastructure: Creates options if the cloud provider has a service interruption Platform: Availability Confidentiality If a security breach happens, privacy and legal liability Data ownerships Concern around e-discovery Software: Who owns the application Where are the applications locations Source:  CISM® Review Manual 2012 , © 2011, ISACA. All rights reserved. Used by permission. Exhibit 3.15
• #22: Some things to consider: Private Cloud: Cloud services with minimum risk May not provide scalability and agility of public cloud services Company wants higher control over the environment Community Cloud: Data may be stored with the data of competitors Company needs more than one organization in the company access to the cloud Public Cloud: Data may be stored in unknown locations and may b easily retrievable Company wants general public/large industry group access to the cloud Hybrid Cloud: Aggregate risk from having different cloud computing development models Data should be classified and labeled to assign correct type Source:  CISM® Review Manual 2012 , © 2011, ISACA. All rights reserved. Used by permission. Exhibit 3.16
• #27: Some business processes are more important than other business processes. Sales is more important in the short term than engineering, and possibly more than the factory. That is why business processes are prioritized.
• #28: 2
• #29: 3---Large RTOs mean the application can run manually with little problem for an extended length of time. This is associated with services classified as sensitive or nonsensitive.
• #30: 2---RPO requires recovery of data (gathered in the past) immediately. Therefore, the correct answer is data mirroring (or using redundant disks).
• #32: This activity diagram shows that some events can happen in parallel, including all the tasks to the right. In some cases there is a security committee, and anyone on the committee can decide a disaster has occurred. There is also a procedure that includes the criteria for making the declaration in the first place. Once that determination is made, disaster protocols can begin.
• #33: People’s lives take FIRST PRIORITY is often a question on a CISA or CISM exam.
• #34: Each of these potentially need addressing
• #35: Here Event Recovery is how to react or recover from the incident. Business Continuity is how Alternate Processing mode should operate.
• #37: Mean time means statistical average.
• #39: Start with the simplest tests and proceed to the more complex tests. From: All-in-One CISSP Exam Guide, 4 th Edition, Shon Harris, McGraw Hill, 2008
• #40: Testing incident response can start with easier operations and proceed to more complex. Often part of the problem is the long time it takes or the errors which are made, which can be optimized by practice.
• #42: When testing IR or DR, there are three stages for the testing.
• #44: This is an optional slide for Computer Scientists, but may be useful for MIS or IT majors. It is also necessary information for CISA applicants.
• #47: 4
• #48: 3---The most critical asset for a company is its data. The backup-restore must be tested to ensure that this critical data is always available.
• #49: The Desk-based paper test is the first of the three tests, and is considered to be the most critical to perform.
• #50: 1
• #51: 4. Business Impact Analysis
• #52: 3
• #53: 2
• #54: MINOR CHANGES TYPED FULL NAME INSTEAD OF ABBREVIATION (MEGAN)
• #55: Vocabulary answers with multiple words will include spaces between words. Definitions for crossword puzzle are adapted from CISA ® Certified Information Systems Auditor All-in-One Exam Guide, Peter H Gregory, McGraw-Hill Co., 2010.
• #57: There will be more threat ideas in the Workbook
• #58: There will be more threat ideas in the Workbook
• #59: A note here is that sometimes the RTO varies by day of year (scheduling system for a school is most important the week before and first week of school.) Also, management and people involved with a database may disagree, in which case management sees the larger picture, and their opinion is most important. However a risk manager may consider both perspectives.
• #60: The full procedure for handling would be documented in section 5 of the workbook.