Instructor: Business impact analysis. 2 2
In this lesson, we are going to talk about the concept 3 3
of a business impact analysis, 4 4
and this is really focused on 5 5
how do things affect our business. 6 6
Now, when I talk about a business impact analysis, 7 7
this is also abbreviate as BIA. 8 8
This is a systemic activity 9 9
that identifies organizational risks 10 10
and determines their effect on ongoing, 11 11
mission critical operations. 12 12
Let me give you a great example 13 13
of a business impact analysis from my own company. 14 14
My company happens to reside in Puerto Rico. 15 15
Puerto Rico is a small island in the Caribbean. 16 16
Now you can see it here on the screen. 17 17
Now, because our company is in Puerto Rico, 18 18
we have to worry about natural disasters 19 19
and their impact to our business. 20 20
For example, after a massive hurricane in 2017, 21 21
the island of Puerto Rico was without power for months. 22 22
So when we decided to move our company to Puerto Rico, 23 23
we had to consider the impacts 24 24
to our employees and our business 25 25
if another huge storm came through 26 26
because we are in Hurricane Alley 27 27
and we're likely to get more storms. 28 28
Now, another thing we have in Puerto Rico 29 29
that happened recently is earthquakes. 30 30
So, right after I moved my company to Puerto Rico, 31 31
the island started shaking 32 32
and started having a series of earthquakes 33 33
at the southern part of our island. 34 34
Now this started creating damage to many businesses, houses 35 35
and churches, as you can see here. 36 36
Now, because of our choice to be based out of Puerto Rico, 37 37
our company, our employees and my family 38 38
all have to have primary and backup plans 39 39
to continue our operations 40 40
even when the local power grid goes offline 41 41
due to storms or earthquakes or any other reason. 42 42
That is one of the main things we have to think about 43 43
as part of our business impact analysis. 44 44
Now, when you're conducting your business impact analysis, 45 45
this is going to be governed by metrics 46 46
that express your system in terms of availability. 47 47
For example, are you a hundred percent available 48 48
or are you 90% available? 49 49
In our company, we try to achieve 99% uptime, 50 50
meaning we want to be available to you 99% of the time 51 51
during normal business hours. 52 52
Now, when we start talking about these metrics, 53 53
there are lots of different ones we have to consider. 54 54
We have things like our maximum tolerable downtime or MTD. 55 55
We have recovery time objective, RTO; 56 56
the work recovery time, WRT 57 57
or recovery point objective, RPO. 58 58
Let's talk about each of these. 59 59
Now, when we talk about a maximum tolerable downtime or MTD, 60 60
this is the longest period of time 61 61
a business can be inoperable, 62 62
without causing irrevocable business failure. 63 63
Essentially, how long can you be down 64 64
without going out of business? 65 65
Now, the MTD is going to be different for each organization 66 66
and even within each organization, 67 67
each of your business processes can have its own MTD. 68 68
For example, some may be just a couple of minutes 69 69
or a couple hours for critical functions. 70 70
You may have up to 24 hours for urgent functions 71 71
and up to seven days or longer for normal functions. 72 72
It really does depend on your organization 73 73
and you have to figure that out for yourself. 74 74
Now, the MTD is going to set your upper limit 75 75
on the recovery time that the system 76 76
and the asset owners have to have to resume your operations. 77 77
So, keeping that in mind, 78 78
let's take a look at my own business. 79 79
I already mentioned that 80 80
power was a really important thing for us. 81 81
So, we know that power is critical 82 82
to our business functions. 83 83
Without it, we really can't do our job. 84 84
I can't film courses and I can't answer student questions 85 85
if I don't have power to turn on my computers 86 86
and be able to run our internet. 87 87
Now without this power, we can't do our job at all. 88 88
So we have multiple backup systems 89 89
to protect power to our building. 90 90
First, we have power from our local electrical company 91 91
coming through the wires on their grid. 92 92
Then, we have solar power that provides us a backup 93 93
during the day if the grid goes out 94 94
and it actually reacts as our primary electrical source 95 95
during the day 96 96
because it's so bright and sunny in Puerto Rico. 97 97
Now, after that, 98 98
we have some Tesla power walls that we've installed. 99 99
These are batteries and these collect power 100 100
from our solar system during the day 101 101
and that way, even if the grid goes out, 102 102
we can end up having those batteries 103 103
provide the power to us. 104 104
And that can happen at night as well. 105 105
When the sun goes down, we can actually survive 106 106
off those batteries if the grid is gone. 107 107
Now, if it becomes cloudy, then the solar won't work. 108 108
Well, we still have the batteries 109 109
and so we have primary of grid, secondary solar, 110 110
tertiary of batteries. 111 111
But for us, that's not enough. 112 112
We actually, in addition to that, 113 113
have a diesel generator as well, 114 114
and that diesel generator has a hundred gallons of fuel. 115 115
That's enough for us to run seven days straight 116 116
without the need for more fuel. 117 117
So, for us to be without power takes a lot these days 118 118
because we have the grid, we have solar, we have battery, 119 119
we have diesel, we have all of these systems in place 120 120
because we realize 121 121
that is an important mission essential thing for us 122 122
is to have power for us to be able to do our jobs. 123 123
Now, if the power grid goes out for more than 60 minutes, 124 124
we found another issue though 125 125
and that's that our primary internet connection 126 126
from our cable provider dies. 127 127
Now, that isn't a problem for me if I'm filming 128 128
but if I'm trying to answer your questions 129 129
and do student support, we can't do that without internet 130 130
because we have to be able to reach to you, right? 131 131
And so that's another issue for us 132 132
and so we have a secondary service for that. 133 133
We have a cellular modem that we use as a backup. 134 134
Now we realized recently there was a big storm 135 135
that came through and our area lost power for three days. 136 136
Now we didn't lose power 137 137
'cause we had all these systems in place, 138 138
but our internet connection died. 139 139
And so we tried to switch over to the cellular modem 140 140
and we found out the speed was horrible. 141 141
Why? 142 142
Because everybody else was out as well 143 143
and they all went onto their modems 144 144
and because they wanted to a cellular modem, 145 145
the cell towers were being flooded with users. 146 146
And so we were getting speeds that were 10 or 20 or 30 147 147
or 40 kilobits per second 148 148
and we were hardly able to even open up our ticket system 149 149
to be able to answer our students' questions. 150 150
So now that we've learned from that, 151 151
we have a third internet provider as well 152 152
that provides a service over a microwave 153 153
and they have a better backup plan for power outages. 154 154
So they maintain services up 155 155
even when the local cable company is down. 156 156
So this helps eliminate that bottleneck. 157 157
My point here is that you have to do this business impact 158 158
for yourself in your organization 159 159
and figure out what things are critical to your operations 160 160
and put things in place to help protect those. 161 161
So when I look at my support services, 162 162
what is our MTD for our support services? 163 163
Well, we calculated that our maximum tolerable downtime 164 164
is 12 hours. 165 165
Now how do I come up with 12 hours? 166 166
Well, we started thinking about if I was a student, 167 167
what was the longest period of time I would want to go 168 168
without getting an answer to my questions? 169 169
And we figured that 12 hours was a reasonable time 170 170
in an emergency situation. 171 171
Now to accommodate that, 172 172
we actually have our staff split in two parts. 173 173
Half of my team resides in Puerto Rico, 174 174
the other half of my team is in the Philippines. 175 175
They are 12 hours off sync from each other. 176 176
So, when it's daytime in the Philippines, 177 177
it's nighttime in Puerto Rico. 178 178
And when it's daytime in Puerto Rico, 179 179
it's nighttime in the Philippines. 180 180
And so we actually can cover almost 24 hours a day 181 181
using these two locations 182 182
because each side works eight hours 183 183
and there's a little bit of time 184 184
that isn't covered by both teams. 185 185
Now that again works within our 12 hours of time. 186 186
Now the other good thing about this is 187 187
because they're so geographically distanced, 188 188
if there's a big storm that takes out Puerto Rico, 189 189
hopefully it doesn't affect the Philippines. 190 190
If there's a big storm that takes out the Philippines, 191 191
hopefully it won't affect Puerto Rico. 192 192
And so by having our geographic diversity here, 193 193
it allows us to maintain that 12 hour response time 194 194
because even if Puerto Rico was down, 195 195
well in the 12 hours, the Philippines team would be awake 196 196
and they'll be able to take on that load 197 197
of being able to answer your questions. 198 198
And so that's why we do that 199 199
and that's why we break up our company. 200 200
It was a risk management decision that we've made 201 201
to provide better service to our students. 202 202
Now again, you need to figure out what your MTD is 203 203
for your company in the real world 204 204
so you can design your risk management plan 205 205
around supporting that MTD. 206 206
What we've done for us 207 207
was thinking about the biggest threats to us 208 208
which are natural disasters. 209 209
And so we have our MTD built around that 210 210
for our student support services 211 211
and we put power and internet connectivity 212 212
at the top of that list of things that we need to have, 213 213
two and three and four different mechanisms 214 214
to be able to provide backups to our backups 215 215
to make sure we can always support you. 216 216
Now the next one we want to talk about is our RTO. 217 217
This is our recovery time objective. 218 218
Now this is the length of time it takes after an event 219 219
to resume your normal business operations and activities. 220 220
When you start thinking about recovery time objective, 221 221
I want you to think about the fact of something went down, 222 222
we lost power. 223 223
How quickly do you need it back? 224 224
In my case, we have a 60 second time for power. 225 225
We want to make sure our power is back up and online 226 226
within 60 seconds. 227 227
Now, is that achievable? 228 228
Yes. 229 229
If you have a backup diesel generator, 230 230
it will turn on in about 45 seconds 231 231
and transfer power to the diesel generator. 232 232
Now, my wife wasn't happy with 45 seconds or 60 seconds 233 233
and she wanted a recovery time of zero. 234 234
Now, can I achieve that? 235 235
The answer is yes, and that's one of the reasons 236 236
why we have those battery backup systems 237 237
because if power goes away, 238 238
those batteries come on instantly. 239 239
There is zero lag time there. 240 240
And so we're able to hit a recovery time objective for power 241 241
of zero seconds. 242 242
Now the overall power of getting it back to the grid, 243 243
we can't control that. 244 244
That's up to our local power company, but we can make sure 245 245
that we can recover our business 246 246
and make sure we're on battery, on solar 247 247
or on generator within zero seconds 248 248
and that's our recovery time objective. 249 249
Now the next one we want to talk about is work recovery time 250 250
or WRT. 251 251
This is the length of time in addition to the RTO 252 252
of individual systems to perform reintegration and testing 253 253
of a restored or upgraded system following an event. 254 254
So let me give you an example. 255 255
Let's say in my organization, we had a power outage 256 256
and we didn't have the batteries yet. 257 257
We had to rely on those generators. 258 258
So we had a 60 second recovery time. 259 259
Well, in 45 seconds, power comes back up. 260 260
But if those systems went down because of a power surge 261 261
and I had to replace one of my servers, 262 262
well that's going to take additional work recovery time. 263 263
I fixed the main problem, 264 264
the recovery time objective of getting the power up, 265 265
but now I have to fix the second and third order effects 266 266
to get work product going again 267 267
which might be rebooting a computer, 268 268
it might be rebuilding a computer, 269 269
it might be replacing a hard drive. 270 270
Whatever those things are, 271 271
I have to perform that reintegration and testing 272 272
to bring those systems back online 273 273
in an upgrade or restored state 274 274
to be able to get us back to regular work product. 275 275
And our final one we want to talk about is RPO. 276 276
This is our recovery point objective. 277 277
This is the longest period of time 278 278
an organization can tolerate lost data being unrecoverable. 279 279
Now, the way I like to think about this one 280 280
when I think about RPO is think about ransomware. 281 281
If you have ransomware on a system, 282 282
it's going to encrypt your files. 283 283
Now you've got a couple of choices here. 284 284
You can pay the ransom, which we never recommend. 285 285
You could try to crack the ransomware key 286 286
which could take you days, weeks or months or years 287 287
depending on how strong it is 288 288
or you can actually wipe that system 289 289
and recover from a known good backup. 290 290
Well, that's great. 291 291
Let's go ahead and choose that option. 292 292
Well, if we do that, what is the longest period of time 293 293
that we can tolerate data loss? 294 294
Well, there's going to be time that we're going to be lagging 295 295
as we're recovering all that data back 296 296
and that data may have several hours 297 297
since it was last backed up. 298 298
For instance, if you run your backup once a day at midnight, 299 299
that's when your data was backed up. 300 300
And if this ransomware hits you at six in the morning, 301 301
you have six hours worth of lost data 302 302
because you don't have a backup of that. 303 303
This is what we're talking about 304 304
when we're talking about recovery point objective. 305 305
That six hours is going to be lost period of time. 306 306
And so if your RPO was 12 hours, that's fine. 307 307
If your RPO is four hours, you've just broken your RPO. 308 308
So you need to keep that in mind. 309 309
When you're thinking about your recovery point objective, 310 310
you are focused on how long you can be without your data. 311 311
That is the whole idea here. 312 312
Now, when we start thinking about your MTD and your RPO, 313 313
these are key terms that you need to know for the exam. 314 314
They're going to help you determine 315 315
which business functions are critical 316 316
and they're going to specify appropriate risk countermeasures 317 317
to help you make sure that you're going to be able 318 318
to get those systems up and running 319 319
and within those MTD and RPOs. 320 320
For example - if your RPO is measured in days, 321 321
then a simple tape backup will work fine 322 322
or you can use a network attached storage array 323 323
or something like that. 324 324
But if your RPO is zero or measured in minutes or seconds, 325 325
then a more expensive server cluster backup 326 326
and redundancy solution is going to be needed. 327 327
A good example of this is my own company. 328 328
We have a server cluster backup and full redundancy solution 329 329
for our web servers. 330 330
This is because we can't afford to be down for long periods 331 331
of time when over 200,000 students 332 332
are relying on our servers to learn from our videos 333 333
and our practice exams 334 334
to prepare to pass their certifications. 335 335
When I sold you a course, I sold you access to that course. 336 336
We want to make sure you have access and we can't say, 337 337
'Oh! I'm sorry. 338 338
We lost all of your data for the last three weeks. 339 339
We're going to have to have you start over.' 340 340
So we want to make sure we have that set up right. 341 341
And so we've taken the risk management mitigations 342 342
to help make sure we maintain a good MTD and RPO 343 343
based on that need. 344 344
Keeping our MTD very low in time 345 345
and our RPO very low in time so you get a better experience.