Cybersecurity Fundamentals Quiz

Chapter 5: Business Continuity Planning and Disaster Recovery Planning

• Learning Outcomes: After studying this chapter, students will be able to understand Business Continuity Management (BCM), the phases in BCP development, the BCM process, different types of plans, backup types, Incident Management Plan (IMP) implementation, and Disaster Recovery Procedural Plan (DRPP) components.

Chapter Overview

• BCM Process & Cycle, Types of Backups, BCP and types, DRP: A diagram illustrates the relationships between Business Continuity Plans (BCP), Business Continuity Management (BCM) processes, Types of Backups, and Disaster Recovery Plans (DRP).

• Attack on AIIMS Delhi Servers (2022): A ransomware attack on AIIMS Delhi servers in 2022 highlighted the vulnerability of healthcare organizations to cyber threats. This incident led to data breaches and disruptions in hospital operations.

• Establishment of AIIMS e-hospital: AIIMS Delhi became the country's first fully digital public hospital in 2016 through the Digital India initiative.

• Ransomware Attack (2022): A significant cyberattack on AIIMS Delhi servers on Nov 23, 2022, resulted in the encryption of 1.3 terabytes of data and the compromise of patient records.

• Implications of the Attack: Compromised patient data, blocked internet services, disruption of digital hospital services, and the need for manual operations to keep the hospital going for a period.

Why it Matters?

• Data Exposure: The attack potentially exposed the data of approximately 40 million patients and healthcare workers, raising concerns about data security in healthcare institutions.

• Remedial Actions: The hospital worked to restore systems and address the impact of the cyber-attack, focusing on manual processes temporarily and working to restore the e-hospital applications.

Some Crucial Lessons to be learnt

• Cybersecurity Measures: Emphasizes the critical need for robust cyber security measures to protect sensitive information from cyberattacks and highlights the importance of network segmentation as a critical security measure.

Need of Business Continuity Management (BCM)

• Reliance on Supply Chain: BCM is crucial for managing disruptions in today's interconnected globalized world. It covers risk management and compliance with government regulations.

• Business Continuity Management (BCM): is a process that helps organizations maintain and restore critical functions to ensure business continuity during disruptions or disasters.

Scope of Business Continuity Management (BCM)

• Advantages: BCM can proactively assess risks, develop response plans, minimize damage, and efficiently demonstrate responses during crises or testing exercises.

Business Continuity Policy (BCM Policy)

• Objectives of BCP: The primary aim of Business Continuity Planning is to minimize losses (financial and reputation) during disasters and to enable quick recovery of operations.

Business Continuity Planning (BCP)

• Business Contingency: A business contingency refers to an event that has the potential to disrupt operations. It can range from minor disruptions like a power outage to major disasters like natural disasters.

• Business Continuity Planning (BCP): A framework for managing disruption or disaster that reduces critical business impact. It describes plans for response, recovery, and continuation of critical business functions.

• Incident Response Plan: A crucial part of BCP to deal with emergencies such as cyberattacks, physical damage, or similar crises.

Business Continuity Planning (BCP) – Phases

• Phase 1 – Pre-Planning Activities (Project Initiation): This phase focuses on understanding the existing environment, defining the plan's scope, and setting up project schedules and teams. It will include defining recovery requirements, and obtaining commitment to the program from senior management and staff.

• Phase 2 – Vulnerability Assessment and General Definition of Requirements: This involves identifying possible threats and vulnerabilities, and assessing the potential impact on the organization. Security and controls are key aspects of this phase, and measures to reduce the likelihood of disruption should be identified.

• Phase 3 – Business Impact Assessment (BIA): Enables the identification of critical systems, processes, and functions, their associated economic implications if disrupted, and to determine how long the organization can survive without access to these elements.

• Phase 4 - Detailed Definition of Requirements: Enables the definition of specific recovery plans to address the identified business requirements and needs. This will include all necessary hardware, software, personnel, resources and processes needed to achieve the restoration of services.

• Phase 5 - Plan Development: Defining and documenting recovery plans outlining detailed operational procedures and processes. This also defines the roles and responsibilities of staff involved..

• Phase 6 - Testing/Exercising Program: The testing phase assesses the plans' effectiveness and ensures that recovery procedures are workable and compliant with the plan.

• Phase 7 – Maintenance Program: Regularly testing, revising, and updating the plans to reflect changes in the environment and processes, to ensure that the plan remains relevant and up-to-date following implementation.

• Phase 8 - Initial Plan Testing and Implementation: Testing the plans, identifying issues, and refining the plans based on test results or modifications.

Business Continuity Management (BCM) Cycle

• Fig 5.2: BCM Cycle: The cycle is an iterative process, which means that after the plan has been implemented, it must be tested in order to ensure that it works as anticipated.

Types of Plans

• Emergency Plan: The plan outlines the actions for immediate response to a disaster impacting human life or business operations.

• Fallback and Resumption Procedures: These procedures outline actions to return to normal operations in a timely fashion.

• Incident Management Plan (IMP): Used to manage incidents or crises. This plan provides protocols for managing the impact of various potential emergencies and their consequences.

• Contingency Plan: Outlines the steps an organization will take to resume critical business activities after a disruptive event like system failure, natural disaster etc.

Disaster Recovery Plan

• Scope of Recovery Plan: Outlines the steps and procedures, including the personnel, resources, and processes involved to restore essential business operations.

BCM Testing and Maintenance

• BCM Testing Plan: Tests the plans' effectiveness and identifies areas for improvement, to confirm that the plans are workable, comprehensive, and accurate.

Alternate Processing Facility Arrangements

• Cold Site: Provides essential infrastructure and utilities for restoring operations, potentially allowing for some downtime during recovery. Organizations might enter contracts with other organizations for access to a cold site.

• Warm Site: Offers more operational infrastructure than a cold site, including some necessary equipment, allowing for shorter recovery times.

• Hot Site: A fully equipped facility that mirror the existing IT systems and software, and can be activated quickly; providing the fastest recovery option. Often shared with other organizations.

Types of Backups

• Full Backup: Copies all files in a specified location.

• Incremental Backup: Backs up only files that have changed since the last full or incremental backup.

• Differential Backup: Backs up all files that have changed since the last full backup. Requires the last full backup, unlike incremental backup which can be applied alone.

• Mirror Backup: Creates an exact copy of the source data. Any changes to the source data will also be reflected in the mirror backup.

Methods for testing the plan

• Testing should be based on reasonable scenarios that are a likely possibility. This can be accomplished through simulations or drills, involving individuals or groups in the required roles.