业务连续性规划剖析课件

BusinessContinuityPlanning(BCP)&DisasterRecoveryPlanning(DRP)PresentedbyJeffSmith,CISSP1BusinessContinuityPlanning(BusinessContinuityPlanning(BCP)&DisasterRecoveryPlanning(DRP)Howtopreservecriticalbusinessfunctionsinthefaceofadisaster.OverviewStrategicDiagramChartOverviewReviewSummary2BusinessContinuityPlanning(TheBCPdomainaddresses:ContinuationofcriticalbusinessprocesseswhenadisasterdestroysdataprocessingcapabilitiesPreparation,testingandmaintenanceofspecificactionstorecovernormalprocessing(theBCP)3TheBCPdomainaddresses:ContiDisasters–natural,man-madeFire,flood,hurricane,tornado,earthquake,volcanoesPlanecrashes,vandalism,terrorism,riots,sabotage,lossofpersonnel,etc.Anythingthatdiminishesordestroysnormaldataprocessingcapabilities4Disasters–natural,man-madeFDisastersaredefinedintermsofthebusinessIfitharmscriticalbusinessprocesses,itmaybeadisasterTime-baseddefinition–howlongcanthebusinessstandthepain?Probabilityofoccurrence5DisastersaredefinedintermsBroadBCPobjectives-CIAAvailability–themainfocusConfidentiality–stillimportantIntegrity–stillimportant6BroadBCPobjectives-CIAAvaiBCPobjectiveCreate,document,test,andupdateaplanthatwill:AllowtimelyrecoveryofcriticalbusinessoperationsMinimizelossMeetlegalandregulatoryrequirements7BCPobjectiveCreate,documentScopeofBCPUsedtobejustthedatacenterNowincludes:DistributedoperationsPersonnel,networks,powerAllaspectsoftheITenvironment8ScopeofBCPUsedtobejustthCreatingaBCPIsanon-goingprocess,notaproject

withabeginningandanendCreating,testing,maintaining,andupdating“Critical”businessfunctionsmayevolveTheBCPteammustincludebothbusinessandITpersonnelRequiresthesupportofseniormanagement9CreatingaBCPIsanon-goingThefiveBCPphasesProjectmanagement&initiationBusinessImpactAnalysis(BIA)RecoverystrategiesPlandesign&developmentTesting,maintenance,awareness,training10ThefiveBCPphasesProjectmanI-Projectmanagement&initiationEstablishneed(riskanalysis)GetmanagementsupportEstablishteam(functional,technical,BCC–BusinessContinuityCoordinator)Createworkplan(scope,goals,methods,timeline)InitialreporttomanagementObtainmanagementapprovaltoproceed11I-Projectmanagement&initiII-BusinessImpactAnalysis(BIA)Goal:obtainformalagreementwithseniormanagementontheMTDforeachtime-criticalbusinessresourceMTD–maximumtolerabledowntime,alsoknownasMAO(MaximumAllowableOutage)12II-BusinessImpactAnalysisII-BusinessImpactAnalysis(BIA)Quantifieslossduetobusinessoutage(financial,extracostofrecovery,embarassment)Doesnotestimatetheprobabilityofkindsofincidents,onlyquantifiestheconsequences13II-BusinessImpactAnalysisII-BIAphasesChooseinformationgatheringmethods(surveys,interviews,softwaretools)SelectintervieweesCustomizequestionnaireAnalyzeinformationIdentifytime-criticalbusinessfunctions14II-BIAphasesChooseinformaII-BIAphases(continued)AssignMTDsRankcriticalbusinessfunctionsbyMTDsReportrecoveryoptionsObtainmanagementapproval15II-BIAphases(continued)AssIII–RecoverystrategiesRecoverystrategiesarebasedonMTDsPredefinedManagement-approved16III–RecoverystrategiesRecovIII–RecoverystrategiesDifferenttechnicalstrategiesDifferentcostsandbenefitsHowtochoose?Carefulcost-benefitanalysisDrivenbybusinessrequirements17III–RecoverystrategiesDiffeIII–RecoverystrategiesStrategiesshouldaddressrecoveryof:BusinessoperationsFacilities&suppliesUsers(workersandend-users)Network,datacenter(technical)Data(off-sitebackupsofdataandapplications)18III–RecoverystrategiesStratIII–RecoverystrategiesTechnicalrecoverystrategies-scopeDatacenterNetworksTelecommunications19III–RecoverystrategiesTechnIII–RecoverystrategiesTechnicalrecoverystrategies–methodsSubscriptionservicesMutualaidagreementsRedundantdatacentersServicebureaus20III–RecoverystrategiesTechnIII–RecoverystrategiesTechnicalrecoverystrategies–subscriptionservicesitesHot–fullyequippedWarm–missingkeycomponentsCold–emptydatacenterMirror–fullredundancyMobile–trailerfullofcomputers21III–RecoverystrategiesTechnIII–RecoverystrategiesTechnicalrecoverystrategies–mutualaidagreementsI’llhelpyouifyou’llhelpme!InexpensiveUsuallynotpractical22III–RecoverystrategiesTechnIII–RecoverystrategiesTechnicalrecoverystrategies–redundantprocessingcentersExpensiveMaybenotenoughsparecapacityforcriticaloperations23III–RecoverystrategiesTechnIII–RecoverystrategiesTechnicalrecoverystrategies–servicebureausManyclientssharefacilitiesAlmostasexpensiveasahotsiteMustnegotiateagreementswithotherclients24III–RecoverystrategiesTechnIII–RecoverystrategiesTechnicalrecoverystrategies–dataBackupsofdataandapplicationsOff-sitevs.on-sitestorageofmediaHowfastcandataberecovered?Howmuchdatacanyoulose?Securityofoff-sitebackupmediaTypesofbackups(full,incremental,differential,etc.)25III–RecoverystrategiesTechnIV–BCPdevelopment/implementationDetailedplanforrecoveryBusiness&servicerecoveryplansMaintenanceAwareness&trainingTesting26IV–BCPdevelopment/implemeIV–BCPdevelopment/implementationSampleplanphasesInitialdisasterresponseResumecriticalbusinessopsResumenon-criticalbusinessopsRestoration(returntoprimarysite)Interactingwithexternalgroups(customers,media,emergencyresponders)27IV–BCPdevelopment/implemeV–BCPfinalphaseTestingMaintenanceAwarenessTraining28V–BCPfinalphaseTesting28V–BCPfinalphase-testingUntilit’stested,youdon’thaveaplanKindsoftestingStructuredwalk-throughChecklistSimulationParallelFullinterruption29V–BCPfinalphase-testingUV–BCPfinalphase-maintenanceFixproblemsfoundintestingImplementchangemanagementAuditandaddressauditfindingsAnnualreviewofplanBuildplanintoorganization30V–BCPfinalphase-maintenaV–BCPfinalphase-trainingBCPteamisprobablytheDRteamBCPtrainingmustbeon-goingBCPtrainingneedstobepartofthestandardon-boardingandpartofthecorporateculture31V–BCPfinalphase-trainingReferencesOfficial(ISC)2GuidetotheCISSPExam32ReferencesOfficial(ISC)2GuidTipsforpassingtheCISSPexamDon’tunderestimatethedifficultyDon’tprocrastinatestudyingDotakepracticeexamsDoreadatleastoneoftheprepbookscovertocovertwiceDoformastudygroupDouse“active”studymethods33TipsforpassingtheCISSPexaBusinessContinuityPlanning(BCP)&DisasterRecoveryPlanning(DRP)PresentedbyJeffSmith,CISSP34BusinessContinuityPlanning(BusinessContinuityPlanning(BCP)&DisasterRecoveryPlanning(DRP)Howtopreservecriticalbusinessfunctionsinthefaceofadisaster.OverviewStrategicDiagramChartOverviewReviewSummary35BusinessContinuityPlanning(TheBCPdomainaddresses:ContinuationofcriticalbusinessprocesseswhenadisasterdestroysdataprocessingcapabilitiesPreparation,testingandmaintenanceofspecificactionstorecovernormalprocessing(theBCP)36TheBCPdomainaddresses:ContiDisasters–natural,man-madeFire,flood,hurricane,tornado,earthquake,volcanoesPlanecrashes,vandalism,terrorism,riots,sabotage,lossofpersonnel,etc.Anythingthatdiminishesordestroysnormaldataprocessingcapabilities37Disasters–natural,man-madeFDisastersaredefinedintermsofthebusinessIfitharmscriticalbusinessprocesses,itmaybeadisasterTime-baseddefinition–howlongcanthebusinessstandthepain?Probabilityofoccurrence38DisastersaredefinedintermsBroadBCPobjectives-CIAAvailability–themainfocusConfidentiality–stillimportantIntegrity–stillimportant39BroadBCPobjectives-CIAAvaiBCPobjectiveCreate,document,test,andupdateaplanthatwill:AllowtimelyrecoveryofcriticalbusinessoperationsMinimizelossMeetlegalandregulatoryrequirements40BCPobjectiveCreate,documentScopeofBCPUsedtobejustthedatacenterNowincludes:DistributedoperationsPersonnel,networks,powerAllaspectsoftheITenvironment41ScopeofBCPUsedtobejustthCreatingaBCPIsanon-goingprocess,notaproject

withabeginningandanendCreating,testing,maintaining,andupdating“Critical”businessfunctionsmayevolveTheBCPteammustincludebothbusinessandITpersonnelRequiresthesupportofseniormanagement42CreatingaBCPIsanon-goingThefiveBCPphasesProjectmanagement&initiationBusinessImpactAnalysis(BIA)RecoverystrategiesPlandesign&developmentTesting,maintenance,awareness,training43ThefiveBCPphasesProjectmanI-Projectmanagement&initiationEstablishneed(riskanalysis)GetmanagementsupportEstablishteam(functional,technical,BCC–BusinessContinuityCoordinator)Createworkplan(scope,goals,methods,timeline)InitialreporttomanagementObtainmanagementapprovaltoproceed44I-Projectmanagement&initiII-BusinessImpactAnalysis(BIA)Goal:obtainformalagreementwithseniormanagementontheMTDforeachtime-criticalbusinessresourceMTD–maximumtolerabledowntime,alsoknownasMAO(MaximumAllowableOutage)45II-BusinessImpactAnalysisII-BusinessImpactAnalysis(BIA)Quantifieslossduetobusinessoutage(financial,extracostofrecovery,embarassment)Doesnotestimatetheprobabilityofkindsofincidents,onlyquantifiestheconsequences46II-BusinessImpactAnalysisII-BIAphasesChooseinformationgatheringmethods(surveys,interviews,softwaretools)SelectintervieweesCustomizequestionnaireAnalyzeinformationIdentifytime-criticalbusinessfunctions47II-BIAphasesChooseinformaII-BIAphases(continued)AssignMTDsRankcriticalbusinessfunctionsbyMTDsReportrecoveryoptionsObtainmanagementapproval48II-BIAphases(continued)AssIII–RecoverystrategiesRecoverystrategiesarebasedonMTDsPredefinedManagement-approved49III–RecoverystrategiesRecovIII–RecoverystrategiesDifferenttechnicalstrategiesDifferentcostsandbenefitsHowtochoose?Carefulcost-benefitanalysisDrivenbybusinessrequirements50III–RecoverystrategiesDiffeIII–RecoverystrategiesStrategiesshouldaddressrecoveryof:BusinessoperationsFacilities&suppliesUsers(workersandend-users)Network,datacenter(technical)Data(off-sitebackupsofdataandapplications)51III–RecoverystrategiesStratIII–RecoverystrategiesTechnicalrecoverystrategies-scopeDatacenterNetworksTelecommunications52III–RecoverystrategiesTechnIII–RecoverystrategiesTechnicalrecoverystrategies–methodsSubscriptionservicesMutualaidagreementsRedundantdatacentersServicebureaus53III–RecoverystrategiesTechnIII–RecoverystrategiesTechnicalrecoverystrategies–subscriptionservicesitesHot–fullyequippedWarm–missingkeycomponentsCold–emptydatacenterMirror–fullredundancyMobile–trailerfullofcomputers54III–RecoverystrategiesTechnIII–RecoverystrategiesTechnicalrecoverystrategies–mutualaidagreementsI’llhelpyouifyou’llhelpme!InexpensiveUsuallynotpractical55III–RecoverystrategiesTechnIII–RecoverystrategiesTechnicalrecoverystrategies–redundantprocessingcentersExpensiveMaybenotenoughsparecapacityforcriticaloperations56III–RecoverystrategiesTechnIII–RecoverystrategiesTechnicalrecoverystrategies–servicebureausManyclientssharefacilitiesAlmostasexpensiveasahotsiteMustnegotiateagreementswithotherclients57III–RecoverystrategiesTechnIII–RecoverystrategiesTechnicalrecoverystrategies–dataBackupsofdataandapplicationsOff-sitevs.on-sitestorageofmediaHowfastcandataberecovered?Howmuchdatacanyoulose?Securityofoff-sitebackupmediaTypesofbackups(full,incremental,differential,etc.)58III–RecoverystrategiesTechnIV–BCPdevelopment/implementationDetailedplanforrecoveryBusiness&servicerecoveryplansMaintenanceAwareness&trainingT