CISSP Blog Post 24, Domain 7: Disaster Planning and Restoration

Credit: Post based on CISSP course presented by Dennis Lee, November 2018

Ok, you’ve (hopefully) backed up your data in the last post, so now let’s talk Disaster Planning and restoration.

Some unforeseen factors when planning that you should be aware of may include:

• Your backup site is also impacted by the disaster
• You cannot get to your backup site
• If you have a hot site, it may not be able to accommodate multiple customers all having an issue at the same time
• Your employee’s families may need care as well, reducing available support staff

So what’s the goal of restoration? The goal is to return to your original site with original capacity and data.

Recovery vs. Restoration

Restoration phases include:

1. Is the incident ended?
2. Is it safe to return?
3. Document the losses
4. Salvage the assets
5. Repairs & replacement
6. Return to site (Tier 5 first, all the way up to Tier 1 support employees)
7. Closure – lessons learned, official end of disaster

Pro tip: When you’re documenting your plan put a 1-year expiration date on the plan to force updates and make it obvious which is most recent version.

Speaking of version control – obsolete plans should be:

1. Archived
2. Collected
3. Confirm collection
4. Issue new plan
5. Destroy old plans

Oh… also you – need to be testing your plan. You can do so in multiple ways including:

Testing Type	Method
Checklist or Desk Check	Give each business unit (BU) a copy of the plan and have them run through a checklist to ensure all relevant points are covered.
Structured Walk-through / Tabletop Exercise	Key players get together and review plan collectively.
Simulation Test	Practice drill mobilizing the personnel (e.g. Fire Drill) and rehearse going to assembly point.
Parallel Test	Operational test at alternate site running in parallel with main site (production).
Full Interruption Test	Shutdown production environment and run a live environment at alternate site. Need to have prior management written permission before parallel test conducted.

CISSP Blog Post 3, Domain 1 Disaster Recovery and Business Continuity Planning

Credit: Post based on CISSP course presented by Dennis Lee, November 2018

In this post we will look at three approaches to Disaster Recovery and Business Continuity Planning.

The Umbrella Approach puts Business Continuity Management over all other types of continuity/recovery planning:

Business Continuity Management Umbrella Approach

The Escalation Approach assumes that as the issue gets worse, you move from one type of plans to the next.

Escalation Approach to Disaster Recovery & Business Continuity

The Compartmental Approach is where both BCP and DR plans work in partnership:

Business Continuity Plans	Disaster Recovery Plans
Run by Business Units	Run by Infrastructure (e.g. IT, Facilities, etc.)

Planning steps include:

1. Analyze Business
2. Asses risks to business
3. Develop recovery strategy
4. Develop & document the plan
5. Implement the plan
6. Test & rehearse the plan
7. Maintain & update the plan

Note that you should implement the plan first before you test so that people have the script by which to test.

To summarize:

	Risk Management	Business Continuity Management
Key Starting Method	Risk Analysis	Business Impact Analysis
Key Elements	Assets , Threats (Impacts & Likelihood)	Assets , Threats (Impacts & Likelihood), Time
Types of Incidents	All relevant types	Incidents causing Significant Business Disruption

Common Terminology

• Maximum Tolerable/ Allowable Downtime – Max amount of time a business can tolerate an outage before it cripples the business.
• Recovery Point Objective – minimum staffing, assets, & infrastructure needed to get the critical business running, starting from a certain rollback point.
• Recovery Time Objective – time needed to get the critical business running before the maximum tolerable down time is exceeded. For example:

Category	Max Tolerable Downtime
Tier 1 / Critical	Minutes to Hours
Tier 2 / Urgent	24 hours
Tier 3 / Important	72 hours
Tier 4 /…	Etc.