1. The Business of Security

2. Business of Security Business Continuity Business impact
Incident response
Disaster recovery
Security laws

3. Building a Business Case
A business exists to satisfy business objectives
Security programs are there to support this primary goal
First step in building a case is to understand the business objectives
Security efforts must be described in relation to organization’s mission
Use quantitative and qualitative analysis to justify security measures

4. Business Continuity Planning
A business continuity plan (BCP) describes how a business will continue operations in the face of risk
Vulnerability assessment determines which risks merit attention
Risk = Threat x Vulnerability
A quadrant map is a good tool for vulnerability assessment

5. Vulnerability Assessment
High
Check processing
Flood II I
High
Low
Employee Strike
Tsunami IV
III
Low

6. Continuity Strategy Contingency planning Incident response planning
Disaster recovery planning
Business continuity planning

7. Contingency Planning Contingency planning consists of:
Incident response plan
Disaster recovery plan
Business continuity plan
Incident response involves:
notification of key people
Documenting the incident
Contain the damage due to the incident

8. Contingency Planning Diagram

9. Contingency Planning Timeline

10. Contingency Planning
Primary goal is to restore all systems to pre-failure level
CP requires support of:
Upper level management
IT people
Security people

11. Business Impact Analysis
BIA is the first step in CP
Takes off from where risk assessment ended
Main steps in BIA are:
Threat attack identification
Business unit analysis
Attack success scenarios
Potential damage assessment
Subordinate plan classification

12. Business Impact Analysis
Threat identification includes:
Attack name and description
Known vulnerabilities
Indicators preceding an attack
Information assets at risk from the attack
Damage estimates

13. Business Impact Analysis
Business Unit Analysis includes:
Prioritization of business functions
Identify critical business units
Attack success scenario includes:
Known methods of attack
Indicators of attack
Broad consequences

14. Business Impact Analysis
Potential damage assessment includes:
Actions needed immediately to recover from the attack
Personnel who will do the restoration
Cost estimates for management use
Subordinate plan classification includes:
Classification of attack as disastrous or non-disastrous
Disastrous attacks require disaster recovery plan
Non-disastrous attacks require incident response plan
Most attacks are non-disastrous, e.g., blackout

15. Business Impact Analysis Diagram

16. Incident Response Plan
Responsible people aware of IR plan details
Periodic testing of IR plan as a desktop exercise
Goals to remember (Richard Marcinko):
More sweat in training means less bleeding in combat
Preparation hurts
Lead from the front and not the rear
Keep it simple
Never assume
You get paid for results not your methods

17. Incident Response Plan
Incidents are usually detected from complaints to help desk
Security administrators may receive alarms based on:
Unfamiliar files
Unknown processes
Unusual resource consumption
Activities at unexpected times
Use of dormant accounts

18. Incident Response Plan
Additional incidence indicators:
IDS system detects unusual activity
Presence of hacker tools such as sniffers and keystroke loggers
Partners detect an attack from the organization system
Hacker taunts
How to classify an incident as a disaster?
Organizational controls for an incident are ineffective
Level of damage to the system is severe

19. Incident Response Plan
Incident reaction involves
Notifying proper personnel
Involves notifying people on the alert roster
Notification could be accomplished using a predefined tree structure
Notification is pre-scripted to activate relevant portions of the incident response plan
Designated personnel start documenting the incident

20. Incident Response Plan
Activate incident containment strategies such as:
Take system offline
Disable compromised accounts
Reconfigure firewall as needed
Shut down specific applications such as or database
Might necessitate shutting down the system completely

21. Incident Response Plan
Post-incident actions
Preserve evidence
Activate recovery procedures
Assess damage

22. Disaster Recovery planning
Prioritize recovery of components
Crisis management
Activate recovery from backup data

23. Business Continuity Service Level Agreements Software escrow
ISO addresses business continuity management
Cold / warm / hot site
Restoration vs. recovery
FARM (Functional Area Recovery Management) specifies plans for operational area recovery

24. Business Continuity
Case Study of MIT Business Continuity plan
Case Study of Avaya Business Continuity plan

25. Implementing Controls
Techniques used to manage risks identified in vulnerability assessment
Risk avoidance, mitigation, acceptance
BCP team must determine exactly how these strategies will be applied to each of the risks identified
Not all risks can be handled with technical approaches, some may require education & training or external expertise

26. Maintaining the Plan BCP is a living document
Changes in the environment, the business, and in current technologies will induce new risks
BCP should be flexible and comprehensive enough to absorb changes
However, periodic review and updating of the BCP will be required

27. Disaster Recovery Planning
Disaster recovery planning is used to prepare for continuing an organization’s operations when they are interrupted due to a crisis
A Disaster Recovery Plan (DRP) is the document describing the recovery plan
Goals of a DRP
Resume operations at an alternate facility as necessary
Provide for extended operation at the alternate facility
Prepare for transition back to the the primary facility when possible

28. Selecting the Team Who should be on a disaster recovery team?
Important to cover critical departments and missions within the organization
Size of the organization will dictate size of team
In a larger organization, planning and implementation teams can be different
DRP responsibilities are usually secondary to the team members’ primary roles within the organization

29. Building the Plan
The DRP should describe the processes to follow in the event of disaster
Should detail the responsibilities of all individuals involved in the plan
Should detail resources needed, including financial, manpower, hardware, and software
Selection of at least one alternate facility is a primary challenge
The greater the required capabilities, the more expensive it will be

30. Disaster Recover Facilities
Hot site
Contains all hardware, software, and data required. Capable of taking over production immediately
Warm site
Contains most hardware and software required, does not maintain live copies of data. Capable of taking over production within hours or days.
Cold site
Contains basic power, telecommunications, and support systems. Does not maintain hardware, software, and data. Capable of taking over production within weeks or months.

31. Creative Disaster Recovery
Nontraditional arrangements for disaster recovery are possible and may be suitable for a particular organization
Geographically dispersed organizations might consider mobile facilities
Trailers, mobile homes, air-transportable units
Don’t keep them all in one place
Mutual assistance agreements
Share costs with other organizations
Care must be taken in maintaining confidentiality of data

32. Training
DRP team members need training to prepare for responsibilities under the plan
Initial training
Comprehensive training takes place when individuals are placed on the team
Refresher training
Periodic training to update and refresh team members’ skills and readiness
Length, frequency, and scope of DRP training must be customized to each individual’s responsibilities

33. Testing Checklist review Tabletop exercise
Simplest, least labor-intensive form of testing
Each individual has a checklist of responsibilities under the DRP
During testing, each individual reviews his/her checklist
Can be done as a group or individually
Tabletop exercise
Test facilitator describe a specific disaster scenario
DRP team members verbally walk through their responses to the scenario
Scenarios can be disseminated at the test or in advance

34. Testing Soft test (parallel test) Hard test (full-interruption test)
DRP team members are given a disaster scenario and respond by activating the recovery facility
Recovery facility works in parallel with main facility, does not take responsibility for full operation
A more comprehensive test, also a more expensive test
Hard test (full-interruption test)
Used only rarely in mission critical situations, too disruptive and expensive
Involves full transfer of control to alternative facility and back

35. Implementing the Plan
When a plan must be implemented, the situation is going to be chaotic
Plan must define actions of first responders, whoever they might be
All employees should know what to do if they witness an event that might signal a need for disaster recovery
The authority to declare a disaster situation should be carefully allocated
Possibly to multiple people

36. Maintaining the Plan
The disaster recovery team’s membership, procedures, and tools will change over time
The team should rely heavily on checklists to avoid panic and chaos
Checklists must be up-to-date
The DRP should be continually tested and evaluated with lessons learned debriefings

37. Data Classification
Provides users with a way to stratify sensitive information
Provides a system for applying safeguards appropriate to the level of confidentiality required
Prerequisites for access to classified data are
Security clearance
Need to know
Government and private industry have similar classification systems

38. Security Clearances
Obtaining a security clearance depends on the level and the organization
may involve rigorous background checks
Polygraphs
agreements about disclosure of sensitive information
Security clearances can be granted at various levels
Usually clearance is tied to essential activities of an individual’s current job

39. Need to Know
Need to know is often required in addition to security clearance in order to access sensitive information
Security clearance offers access to broad categories of information
Need to know restricts access to the actual information required for a specific task
Security clearance is normally enforced by a central security office
Need to know is normally enforced by the custodians of the information

40. Classification Systems
Normally government classification systems are more restrictive and bureaucratic than industry systems
U.S. Government Classifications
Top Secret, Secret, Confidential, Sensitive but Unclassified (For Official Use Only), and Unclassified
Common Industry Classifications
Trade Secret, Company Confidential/Proprietary, Unclassified
Trade secrets are often not protected by patents or copyrights, employees must understand legal obligation to not disclose information

41. Security Ethics
Security professionals often have access to highly confidential information
Must exhibit high degree of ethical standards
ISC2 is a professional organization for security personnel
International Information Systems Security Certification Consortium
Has developed a Code of Ethics for information security professionals
Four very general canons

42. Monitoring
Security professionals are often entrusted with monitoring an organization’s internal and external activity
The ethics of handling information gathered during the process of monitoring requires a high degree of discretion and professionalism
Who watches the watchers?
Ensure that the monitors themselves handle information appropriately

43. Computer Security Laws
A number of laws have an effect on the security industry including
Electronic Communications Privacy Act (ECPA)
USA Patriot Act
Children’s Online Privacy Protection Act (COPPA)
Health Insurance Portability and Accountability Act (HIPAA)
Gramm-Leach-Bliley Act
European Union Directive on Data Privacy

44. References Disaster recovery planning exchange http://www.drie.org/
COBRA
COBRA
Business Continuity

45. References
Natural Disasters preparedness
Crisis management
Business Continuity Plan glossary
Avaya white paper on Business Continuity