Contingency Planning
Law Enforcement Involvement
★ When incident violates civil or criminal law, it is
organization’s responsibility to notify proper authorities
★ Selecting appropriate law enforcement agency depends on the
type of crime committed: Federal, State, or Local
★ Involving law enforcement has both advantages and disadvantages:
★ Usually much better equipped at processing evidence,
obtaining statements from witnesses, and building legal cases
★ However, involvement can result in loss of control of chain of
events following an incident
Incident Response and Disaster Recovery
Disaster Recovery
★ Preparation for and recovery from a disaster, whether natural or
man made
★ In general, an incident is a disaster when:
★ organization is unable to contain or control the impact of
an incident
★ OR
★ level of damage or destruction from incident is so severe,
the organization is unable to quickly recover
★ Key role of DRP: defining how to reestablish operations at
location where organization is usually located
Disaster Classifications
★ A DRP can classify disasters in a number of ways
★ Most common method: separate natural disasters
from man-made disasters
★ Another way: by speed of development
★ Rapid onset disasters
★ Slow onset disasters
Planning for Disaster
★ Scenario development and impact analysis are used to
categorize the level of threat of each potential disaster
★ DRP must be tested regularly
★ Key points in the DRP:
★ Clear delegation of roles and responsibilities
★ Execution of alert roster and notification of key personnel
★ Clear establishment of priorities
★ Documentation of the disaster
★ Action steps to mitigate the impact
★ Alternative implementations for various systems components
Crisis Management
★ Set of focused steps taken during and after a disaster
that deal primarily with people involved
★ Crisis management team manages event:
★ Supporting personnel and their loved ones during crisis
★ Determining event's impact on normal
business operations
★ When necessary, making a disaster declaration
★ Keeping public informed about event
★ Communicating with outside parties
★ Two key tasks of crisis management team:
★ Verifying personnel status
★ Activating alert roster
Responding to the Disaster
★ Actual events often outstrip even best of plans
★ To be prepared, DRP should be flexible
★ If physical facilities are intact, begin
restoration there
★ If organization’s facilities are unusable,
take alternative actions
★ When disaster threatens organization at the
primary site, DRP becomes BCP
Business Continuity Planning (BCP)
★ Ensures critical business functions can continue in a disaster
★ Most properly managed by CEO of organization
★ Activated and executed concurrently with the DRP when needed
★ Reestablishes critical functions at alternate site (DRP focuses
on reestablishment at primary site)
★ Relies on identification of critical business functions and
the resources to support them
Exclusive Use Options
★ Hot Sites
★ Fully configured computer facility with all services
★ Warm Sites
★ Like hot site, but software applications not kept
fully prepared
★ Cold Sites
★ Only rudimentary services and facilities kept in readiness
Shared Use Options
Timeshares
Like an exclusive use site but leased
Service Bureaus
Agency that provides physical facilities
Mutual Agreements
Contract between two organizations to assist
Specialized alternatives:
Rolling mobile site
Externally stored resources
Off-Site Disaster Data Storage
To get any BCP site running quickly, organization must be able
to recover data
Options include:
1. Electronic vaulting: bulk batch-transfer of data to an off-
site facility
2. Remote Journaling: transfer of live transactions to an off-
site facility
3. Database shadowing: storage of duplicate online
transaction data
Disaster Recovery and
Business Continuity Planning
Contingency Plan Implementation Timeline
Putting a Contingency Plan Together
★ The CP team should include:
★ Champion
★ Project Manager
★ Team Members
★Business managers
★Information technology managers
★Information security managers
Major Tasks in Contingency Planning
Business Impact Analysis (BIA)
★ BIA
★ Provides information about systems/threats and
detailed scenarios for each potential attack
★ Not risk management focusing on identifying threats,
vulnerabilities, and attacks to determine controls
★ Assumes controls have been bypassed or are
ineffective and attack was successful
★ CP team conducts BIA in the following stages:
★ Threat attack identification
★ Business unit analysis
★ Attack success scenarios
★ Potential damage assessment
★ Subordinate plan classification
Threat/Attack
Identification and Prioritization
★ An organization that uses risk management
process will have identified and prioritized threats
★ These organizations update threat list and add one
additional piece of information -- the attack profile
★ Attack profile: detailed description of activities
that occur during an attack
Business Unit Analysis
Attack Success Scenario Development
★ Next create a series of scenarios depicting impact
of successful attack on each functional area
★ Attack profiles should include scenarios depicting
typical attack including:
★ Methodology
★ Indicators
★ broad consequences
★ More details are added including alternate
outcomes— best, worst, and most likely
Potential Damage Assessment
★ From detailed scenarios, the BIA planning team must
estimate the cost of the best, worst, and most likely
outcomes by preparing an attack scenario end case
★ This will allow identification of what must be done
to recover from each possible case
Subordinate Plan Classification
★ From existing plans, a related plan must be
developed or identified from among existing
plans already in place
★ Each attack scenario case is categorized as
disastrous or not
★ Attack cases that are disastrous find members
of the organization waiting out the attack and
planning to recover after it is over
Sample Disaster Recovery Plan
★ Name of agency
★ Date of completion or update of the plan and test date
★ Agency staff to be called in the event of a disaster
★ Emergency services to be called (if needed) in event
of a disaster
★ Locations of in-house emergency equipment and
supplies
★ Sources of off-site equipment and supplies
★ Salvage Priority List
★ Agency Disaster Recovery Procedures
★ Follow-up Assessment
Testing Contingency Plans
★ Once problems are identified during the testing
process, improvements can be made, and the resulting
plan can be relied on in times of need
★ There are five testing strategies that can be used to
test contingency plans:
★ Desk Check
★ Structured walkthrough
★ Simulation
★ Parallel testing
★ Full interruption
Testing Contingency Plans
Continuous Improvement
★ Iteration results in improvement
★ A formal implementation of this methodology is a process
known as continuous process improvement (CPI)
★ Each time plan is rehearsed, it should be improved
★ Constant evaluation and improvement leads to an
improved outcome
