Instructor: In this lesson, we're going to talk 2 2
about your business continuity plan, or BCP. 3 3
Now, business continuity planning 4 4
or the creation of your business continuity plan 5 5
is going to ensure that the organization 6 6
is able to recover from a disruptive event or a disaster. 7 7
This is a specialized field within an organization, 8 8
one which takes a lot of planning and forethought 9 9
to keep the organization running smoothly 10 10
during an event or incident. 11 11
Now, there are two major terms 12 12
associated with business continuity planning. 13 13
The first is business continuity planning 14 14
or the business continuity plan itself. 15 15
This refers to the plans and processes used 16 16
for your response to a disruptive event. 17 17
Now, the second is a disaster recovery plan, or DRP. 18 18
This refers specifically to plans and processes 19 19
that are used during a disaster. 20 20
Now, the disaster recovery plan 21 21
usually is going to be considered a subset 22 22
of a more complete business continuity plan. 23 23
When you think about a BCP, 24 24
this is a plan that's used for any disruptive event 25 25
or any response to any kind of threat. 26 26
Now, for example, what will you do 27 27
if your domain controller falls victim 28 28
to a ransomware attack 29 29
and all your users can no longer log into the network? 30 30
Well, this would be a disruptive incident 31 31
and it might activate not only your incident response plans, 32 32
but also your business continuity plans. 33 33
That's what we're talking about here. 34 34
Your business continuity plans are all about creating 35 35
a system of preventative actions and recovery steps 36 36
in response to threats that could materialize 37 37
and disrupt your business. 38 38
Now, your BCP may also cover your non-IT things 39 39
that could disrupt your businesses. 40 40
For example, in my business, we rely heavily 41 41
on our ability to take credit card payments online 42 42
from our students. 43 43
So if a merchant processing account was going to be canceled 44 44
for some reason, 45 45
this would affect our ability to take payments 46 46
from all of our students, 47 47
that would have a major issue for our company. 48 48
So as part of our BCP, 49 49
we discuss how we're going to immediately switch 50 50
to our backup credit card processor 51 51
so we can continue our business operations 52 52
and simultaneously work 53 53
with our primary credit card processor 54 54
to get them back online again and get our cards going. 55 55
Now, if our primary processor can't get us back online 56 56
within X number of days, where are they going to shift 57 57
to a tertiary contract that we have set up 58 58
that will allow us to continue operations indefinitely, 59 59
even though that tertiary processor 60 60
may charge us more for each processing transaction. 61 61
This is the basis of a BCP. 62 62
You plan for your primary, secondary, and tertiary actions 63 63
as you want to continue your business operations. 64 64
Now, another example I saw in a previous organization 65 65
was focused on what they would do 66 66
if there was protests in the streets. 67 67
Now, this was an IT organization 68 68
and it may seem kind of weird to you, 69 69
but their headquarters was actually located 70 70
near a major American city. 71 71
Now, when there was protests and riots in that city, 72 72
it disrupted their business 73 73
because their employees couldn't get to the headquarters 74 74
to go do their jobs. 75 75
Now, this was because the streets started getting barricade 76 76
either by the protestors trying to make a point 77 77
or the police trying to hold back the rioters. 78 78
After that incident, the company learned 79 79
that they needed to have a backup plan 80 80
for how they're going to keep their operations running 81 81
all the time 82 82
even if they can't get people physically into the office. 83 83
Now, we just spent a little bit of time 84 84
talking about the basic idea of a BCP, 85 85
but let's touch on the concept of a DRP as well. 86 86
Now, a DRP is your disaster recovery plan, 87 87
and these are a subset of your business continuity plans. 88 88
It's going to focus on disruptive events just like a BCP would, 89 89
but it focuses specifically on how to resume more quickly 90 90
after you have a disaster. 91 91
For example, my offices are located in Puerto Rico, 92 92
which is very likely to suffer from hurricanes 93 93
and earthquakes because of its location in the Caribbean. 94 94
Now, our BCP contains a DRP portion 95 95
that's focused on our response actions 96 96
for both of those things. 97 97
So if we have a hurricane, 98 98
how can we keep our offices open and our servers online 99 99
24 hours a day, seven days a week? 100 100
And if we can't, what are we going to do in response to that? 101 101
What are we going to do if there's an earthquake, 102 102
a fire, a flood, or another disaster? 103 103
All of those things are things we have to think about. 104 104
For example, when we did our risk management analysis, 105 105
we determined it was too risky 106 106
to host our servers within Puerto Rico 107 107
because we have a threat of power losses 108 108
because of hurricanes. 109 109
So we instead built our entire backend infrastructure 110 110
in the cloud, and we use AWS and Google Cloud. 111 111
That way, even if we have a severe disaster in Puerto Rico, 112 112
our operations could continue on. 113 113
Another thing we did is we split our staff 114 114
across multiple locations, both within Puerto Rico 115 115
and in a few other locations around the world. 116 116
For example, my student success team is split evenly 117 117
between Puerto Rico and the Philippines. 118 118
When there's power averages in Puerto Rico, 119 119
the Philippines team takes over operations 120 120
and continues to work to make sure 121 121
students are taken care of. 122 122
Similarly, we've had floods in recent years 123 123
over in the Philippines, 124 124
and our Puerto Rico team had to step up 125 125
and cover for the Philippines team 126 126
because the Philippines team couldn't get to work. 127 127
Now, this way, we can continue our operations 128 128
even in the face of these disasters. 129 129
So now that we've covered the differences 130 130
between a BCP and the DRP it contains, 131 131
for the rest of the section, 132 132
I'm only going to refer to the business continuity plan, 133 133
but when I do, remember, 134 134
I'm referring equally to the BCP and the DRP it contains 135 135
because the only real difference 136 136
is the type of event you're responding to. 137 137
Is it an incident or is it a disaster? 138 138
Now, the development of your business continuity plan 139 139
is the responsibility of the senior managers 140 140
within your organization. 141 141
It's really up to them to drive this effort 142 142
and ensure it's done properly. 143 143
Without their support 144 144
the BCP development is going to certainly stall out and fail. 145 145
For this reason, it is the responsibility 146 146
of senior management to set goals 147 147
for the business continuity and disaster recovery efforts. 148 148
Under senior management, 149 149
a business continuity coordinator is going to be appointed 150 150
and they're going to lead the business continuity committee. 151 151
This committee should have representatives 152 152
from different departments across the organization, 153 153
from IT, legal, security and communications, 154 154
just to name a few. 155 155
This should not just be the IT people doing this thing. 156 156
We all need to work together. 157 157
This committee is going to work 158 158
to determine the recovery priorities 159 159
for the different types of events that may occur 160 160
whether they're disruptive, 161 161
and they're going to be covered by the BCP, 162 162
or a disaster, covered by our DRP. 163 163
This committee is also going to seek to identify 164 164
and prioritize all of our systems that we need to support 165 165
for the continuity of the business, 166 166
and then they report that back to senior management. 167 167
Now, another key part of a good business continuity plan 168 168
is defining the scope of the plan itself. 169 169
Otherwise, you may face scope creep. 170 170
Again, this is a job for senior management 171 171
because they need to determine the level of risk 172 172
they're willing to accept 173 173
based on the organization's risk appetite 174 174
and risk tolerance. 175 175
The BCP can be broken down 176 176
by business function or by geographical area 177 177
if you're working in a very large organization. 178 178
But again, all the pieces must be coherent 179 179
and they must be able to operate together, 180 180
especially during times of crisis. 181 181
While you don't need to create a BCP for the exam, 182 182
you should know the seven major steps to perform 183 183
as outlined in the NIST Special Publication 800-34. 184 184
The first step is to develop a policy 185 185
for contingency planning. 186 186
The second step is to conduct a business impact analysis. 187 187
Your third step is to identify preventative controls. 188 188
The fourth step is to create recovery strategies. 189 189
The fifth step is to develop the business continuity plan. 190 190
The sixth step is to test, train, and exercise that BCP 191 191
and the seventh step is to maintain the BCP. 192 192
Now, we're going to talk more about some of these steps 193 193
as we move through the course. 194 194
Finally, when you're creating your BCP and your DRP, 195 195
you need to consider what type of continuity 196 196
you need to create using these different plans. 197 197
From a technical perspective, we're going to break this down 198 198
into four categories or types of continuity locations. 199 199
Hot sites, warm sites, cold sites, and mobile sites. 200 200
All right, let's take a look at each of these 201 201
and we're going to start with my favorite type of backup site, 202 202
a hot site. 203 203
Now, a hot site is defined 204 204
as a site that is up and running continuously. 205 205
Essentially, at a moment's notice, 206 206
we can switch our operations from our main site 207 207
to our backup site with almost no downtime and no issues. 208 208
Now, this is my favorite type of setup 209 209
because it means you always are up and ready to go 210 210
and you can keep your business moving forward 211 211
even when disaster strikes. 212 212
But the drawback is, 213 213
it's very expensive to have this kind of redundant site. 214 214
For example, to truly have an on-demand 215 215
and ready to go hot site, 216 216
you're going to need to have two of everything. 217 217
If I have a file server in the main office, 218 218
I need to have another file server at the hot site. 219 219
You're going to need to constantly update and communicate 220 220
and mirror the data between both sites 221 221
so you have an update copy at all times. 222 222
Now, in the old days, this was extremely difficult 223 223
and expensive to do, but the good news is, 224 224
with cloud computing, this has become much, much easier 225 225
because you can now have your servers hosted online 226 226
at multiple locations simultaneously using AWS, Azure, 227 227
or the Google Cloud platform. 228 228
Now, while this type of hot site for your servers is great, 229 229
it doesn't fully consider everything you need 230 230
in terms of a hot site. 231 231
Again, what about your office building 232 232
where your employees are actually going to do their work? 233 233
For example, let's say there's a fire 234 234
and your entire headquarters got affected. 235 235
You have smoked damage and water damage now 236 236
because of this fire, and now it's going to take six months 237 237
to rebuild your headquarters. 238 238
Well, if you have a fully redundant cloud-based model 239 239
for your hot site, this means all your data 240 240
is up and running instantly and ready to go. 241 241
But you had 500 people working in that office building 242 242
and now you need to find 500 desks, 500 chairs, 500 phones, 243 243
500 computers, all that stuff to get ready to go 244 244
so people can go to work 245 245
because everything else was destroyed in the fire. 246 246
This is why a hot site is usually not used by most companies 247 247
for their entire business, but instead, 248 248
they use it just for mission critical things 249 249
that have to be up 24 hours a day, 250 250
seven days a week, continuously. 251 251
Now, this brings us to our second category, a warm site. 252 252
A warm site is not fully equipped like a hot site is. 253 253
So remember, in a hot site, we have desks, we have chairs, 254 254
we have network connectivity, we have computers 255 255
and phones and software and everything we need 256 256
so an employee can simply walk in and start working. 257 257
Well, with a warm site, 258 258
we're not ready for an immediate switchover, 259 259
but we can get up and running in just a few days. 260 260
A warm site will already have the fundamentals in place. 261 261
For example, the building has power, it has phone lines, 262 262
and we have network connectivity. 263 263
We may have some desks, but there may not be any phones 264 264
or computers already installed. 265 265
Now, if a disaster happens, 266 266
we can then start installing this technology 267 267
and get people up and running within a few days 268 268
'cause we just need to buy some laptops 269 269
and some monitors and some phones. 270 270
Now, the benefit of a hot site is that instant availability, 271 271
but it comes with a very high price tag. 272 272
Now, a warm site is a little bit cheaper, 273 273
but you're giving up some response time 274 274
because you have to wait a few days 275 275
to get it up and running. 276 276
That's the difference as you look at these things. 277 277
The third category we have is known as a cold site. 278 278
Now, this again, is going to add more time to our recovery, 279 279
but it is cheaper than using a warm site. 280 280
A cold site contains even fewer facilities 281 281
than a warm site does. 282 282
For example, one organization I worked with in the past 283 283
had a cold site that was essentially 284 284
just an empty building they had a lease on. 285 285
They paid a monthly rent for this building 286 286
and nobody worked there. 287 287
The cold site had a few basic facilities 288 288
like the bathrooms and the tables and the chairs, 289 289
but there was no network connectivity, 290 290
there was no phone lines and there was no computers. 291 291
Essentially, it was an empty shell, 292 292
and in the event of a serious disaster of their headquarters 293 293
they could turn this cold site into a new headquarters 294 294
in about one to two months. 295 295
Now, the final category we have is known as a mobile site. 296 296
Now, a mobile site can be a hot site, 297 297
a warm site, or a cold site. 298 298
Basically, up to this point, 299 299
I was discussing how you can go from one building to another 300 300
with a hot, warmer, cold site. 301 301
But with a mobile site, we don't even need buildings. 302 302
Instead, we use independent 303 303
and portable units to provide our recovery. 304 304
Most often, this takes the form of trailers or tents. 305 305
They're delivered to your location 306 306
and connected to your power and internet, 307 307
and that way you can get up and running pretty quickly. 308 308
For example, the US military has something known 309 309
as the DJC2. 310 310
This is the Deployable Joint Command and Control system. 311 311
This thing is an integrated command and control headquarters 312 312
that can be delivered anywhere in the world 313 313
within about 72 hours. 314 314
Now, once it gets on the ground, it takes 'em around 315 315
24 hours to start providing some functionality and service. 316 316
This system is made up of a series of tents 317 317
and they have generators for power, 318 318
they have air conditioning, they have tables and chairs, 319 319
they have phones and network connectivity, 320 320
and they can support up to 200 people 321 321
inside one of these things. 322 322
For example, after a major earthquake in Haiti back in 2010, 323 323
the US military deployed one of these DJC2s there 324 324
to act as the mobile command center 325 325
and run the recovery operations. 326 326
Now, the great thing 327 327
about this type of mobile recovery site 328 328
is that they are fully contained. 329 329
They come with everything you need, including power, 330 330
connectivity, and technicians to run the whole thing. 331 331
So which of these sites should you use? 332 332
Well, this is why senior managers need to be involved 333 333
in the BCP creation process. 334 334
Sometimes you're going to choose one of these 335 335
or you might choose multiple of these, 336 336
breaking them out across different business functions, 337 337
different scenarios or different timelines. 338 338
For example, in my company, we use a full hot site 339 339
for our servers to ensure they're always up 340 340
and operational at all times, 341 341
but we don't use a full hot site for our employees. 342 342
Instead, we have a small office 343 343
and we allow and encourage telework in our organization. 344 344
So for the most part, most of my team members 345 345
are working from their own home offices. 346 346
Since we've designed all our technical backend 347 347
to allow this fully remote workforce, 348 348
if one of their home offices loses internet or power, 349 349
we could simply have them go to a local hotel 350 350
and as all day at internet and power in the hotel, 351 351
they can reconnect and go back to work right away. 352 352
Now, in addition to that, we also plan 353 353
for power outages and internet outages at our office 354 354
because we have primary power delivered by solar panels 355 355
and then we have battery backups 356 356
for the times the sun isn't out. 357 357
Now, if we run out of battery power, 358 358
we also can go to our backup generators, 359 359
and we also have a connection back to the local power grid 360 360
and we could pull power from there too if we needed to. 361 361
See, for internet connectivity, 362 362
we do the same type of thing. 363 363
We have three different connections to our office. 364 364
The first one is a microwave link 365 365
that gives us high speed uploads and downloads. 366 366
If that fails, we have a redundant connection 367 367
from a local cable company, 368 368
and that provides high speed downloads, but slower uploads. 369 369
If both of those fail, 370 370
we also have a cellular modem backup, 371 371
and this provides about 20 megabits per second of service 372 372
for uploads and downloads. 373 373
By layering our internet connectivity 374 374
as part of our business continuity plan, 375 375
we know that our expected response and downtime would be 376 376
for our primary internet connection failure, for example, 377 377
because we can shift to the second one in seconds 378 378
or the third one in seconds after that. 379 379
So when you're creating your BCP and your DRP, 380 380
remember, you can't just think of the technology stack, 381 381
but you also have to think 382 382
about where are your people going to work 383 383
and how are you going to support them long term 384 384
as you attempt to continue to support your operations 385 385
and your customers.