Nortel Networks

This simple study booklet is based directly on the ISC² CBK document.

This guide does not replace in any way the outstanding value of the CISSP Seminar and the fact that you must have been involved into the security field for at least a few years if you intend to take the CISSP exam. This booklet simply intends to make your life easier and to provide you with a centralized resource for this particular domain of expertise.

This is NOT a Nortel Networks sponsored document, nor is it to be indented as a representation of Nortel Networks operating practices.

This document may be freely read, stored, reproduced, disseminated, translated or quoted by any means and on any medium provided the following conditions are met:

[HUTT95] Hutt, Arthur, Seymour Bosworth, Douglas Hoyt. The Computer Security Handbook: Third Edition. John Wiley and sons, 1995.

[ISC991] (ISC)2 CISSP Week 1 Review Material

[KRAU99] Krause, Mikki, Harold Tipton, Editors. The Handbook of Information Security Management 1999. Auerbach, 1999.

Business Continuity Planning is defined as planning that facilitates the rapid recovery of business operations to reduce the overall impact of the disaster, while ensuring continuity of the critical business functions.

Disaster Recovery Planning is defined as the procedures for emergency response, extended backup operations and post-disaster recovery when the computer installation suffers loss of computer resources and physical facilities.

Recovery Planning is defined as the advance planning and preparation which are necessary to minimize loss and ensure continuity of the critical business functions of an organization.

Disaster is defined as an interruption affecting user operation significantly.

Disaster Recovery Planning is defined as a process to identify the critical computing resources in an organization. What potential event could affect or interrupt those services, and planning to respond to those events should they occur.

A Disaster Recovery Plan is defined as a comprehensive statement of consistent actions to be taken before, during and after a disaster.

The First Recovery team is responsible for determining if/when the building can be occupied again, the status of assigned people, initiate alternate site if needed, and activate emergency recovery procedures.

The Second Recovery teams set up and activate the alternate-processing site, retrieve needed materials from backups, install needed equipment, and resume critical work.

The Third Recovery team performs salvage and repair operations at the primary site. It is their job to get the primary site back into normal operation.

The objectives of Recovery Procedure Development include

From [ISC991], section 5, page2,

Business Continuity Planning is defined as planning that facilitates the rapid recovery of business operations to reduce the overall impact of the disaster, while ensuring continuity of the critical business functions.

Disaster Recovery Planning is defined as the procedures for emergency response, extended backup operations and post-disaster recovery when the computer installation suffers loss of computer resources and physical facilities.

The major difference between them is that business continuity planning involves more that just the computer facility, while DRP is focused more at maintaining business operations when the computing facilities are lost.

From [ISC991] Section 5, page 3,

Business depends upon a variety of technology including centralized and decentralized computing systems, special-purpose support systems and communications systems.

Page 7-4 of [HUTT95] defines the elements of Contingency Planning as:

In order for BCP to be effective, [ISC991] recommends that the following people must be involved:

There are several pieces of US legislation and regulatory agencies that require organizations to take appropriate care in safeguarding their information. These include:

All of the following disasters should be planned for, as well as anything that is specific to the organization itself or the locations where the organization is situated. These are found in [ISC991] Section 5, pages 5-6.

The Information Security goals are

From [ISC991] Section 5, page 12, here is the diagram.

The project initiation phase involves the following steps:

From [ISC99] section 5, page 12,

Disaster is defined as an interruption affecting user operation significantly.

Disaster Recovery Planning is defined as a process to identify the critical computing resources in an organization. What potential event could affect or interrupt those services, and planning to respond to those events should they occur.

Disaster Recovery planning according to [ISC991] section5 page 13, involves

The objectives of Disaster Recovery Planning as outlined in [ISC991] Section 5 page 13 are

There are six steps:

The disaster recovery planning team should include representatives (or teams depending upon the size of your organization) from

As in [ISC991] Section 5 page 15, Senior management have an important role in the Disaster Recovery Planning process. It is expected that senior management will demonstrate commitment and support to the program. This is the most critical element of their involvement. Senior management demonstrates this through

[ISC991] section5 page 16 identifies the following complications beyond the disaster

Dealing with media can be a challenge. They will be present on your site as so as it is known that there has been a disaster of some kind, looking for the "Scoop". The disaster recovery plan must include how the media is to handled during the disaster, in order to keep things under control. While the CEO is generally the spokesperson of the company, it is not advisable for the CEO to talk to the press during a disaster.

Rather, [ISC991] recommends the following action plan:

This can be tricky. The planner must be in a positional within the organization to balance the needs of the corporation with the individual business units that would be affected., The must be able to review the corporation charter and viewpoint. They must have the knowledge of the business, which enables them to understand how the disaster can affect the corporation. They must have easy access to executive management and have the credibility and ability to influence senior management when there is a decision to be made.

See [ISC991] Section 5, page 17.

The development of the disaster plan must be prepared by the same people who are going to execute if the time comes. By doing so, it is possible for them to see where they have made an error, and hopefully they nt for all eventualities. Even if they did miss something, they may be able to extrapolate the correct course of action from the plan since they understand it on an intimate level.

The planning organization will include representatives from all of the critical business and support units.

The business unit planners develop plans to restore the critical product and service delivery capability as quickly as possible. They must obtain management approval of the milestone deliverables before moving to the next item. This ensures that management is fully aware of the plan development and the progression of the project. Finally, the business unit planners are in the position to be able to test the plan within their business units, or to test the plan and monitor the progress that their business unit makes through the implementation of the plan.

The support unit planners are responsible for the development of plans to support the critical business functions. Their development is dependant on the business unit planners to forward the requirements to the support teams. Otherwise, their responsibilities are similar to the business unit planners.

The planning organization must also include consolidated area representatives. They will be required based upon the size and/or complexity of the organization. Smaller organizations may not need people in these roles. The need is established by the span of control guidelines for the organization. For example, generally 8-10 people is the optimum number for a single level in a reporting chain to handle. If there are more, then a reporting level is established to properly handle issues and control of the project. These representatives have a similar charter to a corporate program manager but they operate at a division/group or department level.

See [ISC991] section 5, page 18

The critical business units are identified through an examination of the "loss criteria". These criteria re:

From [ISC991] Section 5, page 22:

The critical support units are those that provide a critical service to the business units. They support the local emergency management team, and are involved in the planning process. The following groups are examples of critical support units:

From [ISC991] Section 5, page 23:

The Criticality Survey is implement through a standard questionnaire to tool to gather input from the most knowledgeable people. The intent is to find out what services and systems are critical to keeping the organization in business.

When developing the survey, it is essential that the purpose of the survey is clearly stated in order to avoid any misinterpretations. It is also important to get management approval of the survey before distributing it.

From [ISC991] Section 5, page 24,

The objectives of a Vulnerability Assessment are:

From [ISC991] Section 5, page 27

Hen analyzing and summarizing potential financial impacts, it is important to obtain data from approved outage impact scenarios, with an emphasis on including varying duration of outages. This will improve the reporting as the longer the outage, the greater the cost. However, including different time lengths will also illustrate the projected rate of cost increase.

It is also required that the direct costs associated with the outage be included. Again, outages of varying duration must be included in order to accurately estimate

From [ISC991] Section 5, page 30:

There are several areas to be included in the disaster recovery plan. These are:

From [ISC991] Section 5, page 32-33;

End-user recovery planning is important, as they still expect to be operational while the disaster recovery is underway. Data processing capability to critical to most users on a day to day basis. When a disaster occurs, it may impact a number of services where manual procedures are difficult to implement or maintain on an ongoing basis. Since many data processing failures can be significant, and the recovery can be complex. The resulting service disruption can threaten the organization’s survival.

The end user must be involved in the disaster planning. The can be involved by recognizing the effect that a disaster can have on their ability to work. In the event of a situation serious enough to force the data processing center to move, user procedures should be able to address lost data or transactions, continuation of critical functions until the alternate site is ready, and any procedural changes to account for the alternate site operation.

It may also be a requirement that the user plans be able to change the ways information is input to the system if there is a loss of communications, or specialized equipment.

There are several major strategies for Data Center Backup Planning. These include

From [ISC991] Section 5 page 35:

Mutual aid or reciprocal agreement are arrangements between to companies to provide facilities to the other in the event of a disaster. They require that the two agencies have similar hardware and software computing environments.

Advantages of this form of arrangement is

From [ISC991] Section 5 page 36-37:

Hot, warm and cold sites are generally run through a subscription service. The hot site is defined as a fully configured site with complete hardware and software compatible with the client. This is generally available in hours, hence the term host site.

The warm site is similar to a hot site, although the expensive equipment that can be reliably and quickly obtained is not available on site. The site is ready in hours after the needed equipment arrives.

A cold site is one that is air conditioned and wired, but there is no equipment on site. This is ready for use as soon as the customer’s equipment arrives.

The hot site is preferable because you can be operational n a very short period. It is highly available and the service bureau assures exclusive use of the facility. The site is available immediately when disaster strikes, and supports both short and long term outages. The contract for the hot site includes annual test time to ensure that everything is compatible and can be made operational as expected. Typically, a subscription service will have multiple sites available so you can go the site that is closest to the disaster location.

However, the hot site is the most expensive to maintain. If there is a regional disaster, and someone else uses the same subscription service, there is the possibly of contention for the hot site between one or more companies. If the organization has special or unusual hardware, there are limited choices available to provide support.

The cold site is designed to simply provide a room, air conditioning and power. There is no equipment provided, that is the organization’s responsibility. The cold site is assured of availability for along period of time. They are available I a variety of locations across the country, and the subscription service assures exclusivity of use. It is the least expensive of the three options and practical for situations where the hardware involved is less popular.

The disadvantages associated with the cold site is that testing the plan is not possible since you do not really want to go through the expense of procuring a great of equipment for a short period test.

It is also possible to obtain hot site services through a service bureau. Remember that a service bureau gains it advantage by offering services for a larger customer base. By obtaining hot site services through the service bureau, there is a quick response time and availability of service. It is possible to test the configuration to make sure that it and your plan is effective.

However, the few service bureaus offer this as a service. It costs as much as a hot site, and there is a configuration management problem. As they will continue to configure and modify their system to suit their ongoing business needs, the implementation of your plan may be a problem.

From [ISC991] Section 5, page 43:

The recovery contingency planning events are:

From [ISC991] Section 5, page 45:

From [ISC991], Section 5, page 47,

There are several preventative measures available to the Disaster Recovery Planner. These relate to specific types of threats, including the following:

Recovery capability is assessed through the following:

From [ISC991], Section 5, pages 52-54,

There are a number of benefits to testing the plan on a regular basis. These benefits include