Fundamental Concepts of Data Security: Business Continuity

Business Continuity and the PPRR Framework

• Definition: A proactive process to ensure essential functions survive unexpected disruptions.
• PPRR Framework:     * Prevention: Risk Management Plan to minimize likelihood.     * Preparedness: Business Impact Analysis (BIA) to plan readiness.     * Response: Incident Response Plan (IRP) for immediate action.     * Recovery: Recovery Plan to restore operations; include rehearsal and review.
• Essential References: NIST 800-34 (Contingency Planning Guide for Federal Information Systems).

Risk Management Fundamentals

• Risk Equation: $\text{Risk} = \text{Likelihood} \times \text{Impact}$.
• Residual Risk: Risk remaining after controls are applied. $\text{Residual risk} = \text{Total risk} \times \text{Control gap}$.
• Management Aims:     1. Eliminate removable risks.     2. Mitigate non-eliminable risks.     3. Apply controls to reach an acceptable risk level.     4. Transference via insurance.
• Strategies: Defend, Transfer, Mitigate, Terminate/Avoid, and Accept.

Risk Assessment Methodologies

• Quantitative Assessment: Uses objective, verifiable metrics.     * Single Loss Expectancy (SLE): $\text{SLE} = \text{Asset Value} \times \text{Exposure Factor (EF)}$.     * Annualized Loss Expectancy (ALE): $\text{ALE} = \text{SLE} \times \text{Annualized Rate of Occurrence (ARO)}$.     * Cost-Benefit Analysis (CBA): Evaluates control costs versus potential losses.
• Qualitative Assessment: Uses a Risk Matrix (Likelihood vs. Consequences) to categorize risks as Low, Medium, High, or Extreme (E).

Change Management

• Purpose: Prevents unintended consequences and manages complexity during IT transitions (e.g., hardware, software, patches).
• Procedure: Request $\rightarrow$ Impact assessment $\rightarrow$ Approval $\rightarrow$ Build and test $\rightarrow$ Notification $\rightarrow$ Implementation $\rightarrow$ Validation $\rightarrow$ Documentation.
• Roles: Change Advisory Board (CAB), Change Manager, Administrator, Initiator, and Coordinator.

Business Continuity (BCP) vs. Disaster Recovery (DRP)

• BCP: High-level process for organizational survival and critical function reduction of risk.
• DRP: Sub-component of BCP; technical steps for IT personnel to restore systems and facilities.
• Threat Classifications: Natural (floods/fire), Environmental (power failure), and Human (hacker attacks/operator error).

Business Impact Analysis (BIA) and Recovery Parameters

• Maximum Tolerable Downtime (MTD): Total outage time the organization can survive.
• Recovery Point Objective (RPO): Acceptable data loss measured in time (e.g., "last 4 hours of data").
• Recovery Time Objective (RTO): Target time to resume business operations after a disaster.
• Relationship: Lower RPO and RTO requirements lead to higher recovery costs (e.g., data mirroring).

Recovery Facilities and Testing

• Offsite Facilities:     * Hot sites: Fully configured, ready for immediate switchover.     * Warm sites: Partially equipped; lacks current customer data.     * Cold sites: Basic shell (power/AC) with no equipment.     * Mobile sites and Reciprocal agreements.
• BCP Testing Methods:     1. Structured walk-through: Tabletop discussion.     2. Simulation: Active role-playing of the scenario.     3. Parallel: Running backup systems alongside production.     4. Full-scale: Complete shutdown and relocation to recovery site.

Incident Response (IR)

• Definition: Addressing unauthorized attacks against the AIC (Availability, Integrity, Confidentiality) triad.
• IR Phases: Planning, Detection (Triage), Reaction (Containment/Analysis), Recovery, and Review.
• Triage/Investigation: Includes collecting host-based data (live data, forensic duplication) and network data (logs/traces).
• IR Kit Essentials: High-end hardware with large disk space, boot disks, and block-level copy tools.
• Post-Incident: Timely documentation, evidence retention, and "lessons learned" discussions.