Business Requirements Analysis Flashcards
What is different about health and human safety risks?
It is legal and defensible to accept risks higher than the norm, or greater than your competitors, except risks to health and human safety; these risks must be addressed to the industry standard or the regulatory scheme to which your organization adheres.
BCDR Plans
plans to follow in the event of an outage or disaster
List BCDR architectures in cloud
- On prem, cloud as BCP/DRP - if on prem fails, the failover location is a CSP
- Cloud consumer, primary CSP for BCP/DRP - if part of the cloud provider fails, failover goes to the same CSP at a different location
- Cloud consumer, alternate BCP/DRP - if part of the cloud provider fails, failover goes to a different cloud provider
What is a logical sequence of considerations for BCDR strategy?
- Location - BCDR plans depends on location of the calamity. May require remote location (e.g. flooding, fire, earthquake)
- Failover Architecture - components need to replicate to the same architecture in different location
- Data Replication - maintain a same or less up to date copy of the required data in a different location
- Functionality replication - recreate the same processing capacity in a different location
- Event Anticipation - tooling, functionality and process leading up to the failover response (how and when do you failover)
- Failover Capability - failover capability requires some type of load balancer to redirect user service request to the appropriate service
- Return to Normal - end of the disaster recovery strategy
Asset
Assets can be tangible (HW/SW) or intangible (process, software code, public opinion)
BIA, What is it? How do you do it? Considerations?
Business Impact Analysis - an assessment of the priorities given to each asset and process within an organization
determine a value for every asset (usually in terms of money, but sometimes according to priority/rank, customer perception, or other measures), what it would cost the organization if we lost that asset (either temporarily or permanently), what it would cost to replace or repair that asset, and any alternate methods for dealing with that loss.
Considers the effect or impact any harm or loss of each asset might mean to the organization
Identifies critical paths and single points of failure
Look up and down the chain of dependencies
- Downstream liabilities (if others depend on you, e.g power company)
- Upstream liabilities (if you depend on others, e.g. vendors, suppliers)
How and who should assign valuation/cost in BIA?
Cost can be assigned in various ways including insured value, replacement cost, etc.
Data owners/Line of business manager assign value
BIA vs. BCDR
You do BIA well before BCP and/or DRP
What is the cloud customer always legal liable for?
According to who/what?
according to most of the world’s privacy laws and regulations, the cloud customer is always ultimately legally liable for any loss of data. This is true even if the cloud provider demonstrates negligence or malice.
RPO
Recovery Point Objective - goal for how recent your latest backup/snapshot was or point to rollback to
Amount of data the organization can afford to lose before it impacts business operations
MTD
AKA
Maximum Tolerable Downtime - Maximum amount of time a business can tolerate an outage before the incident causes business failure
MAD - Max Allowable Downtime
RTO
Recovery Time Objective - Time needed to get the critical functions running again (recovery)
WRT
Work Recovery Time - Time needed to configure and to verify the integrity of the recovered system
How does RTO, WRT, and MTD relate?
RTO + WRT <= MTD
Mean Time To Restore/Repair (MTTR)
The average time it takes to restore or repair
Mean Time Between Failures
A measure of how reliable a hardware product is; average time between failures of a HW product
Vertical Analysis
To prioritize the assets and critical systems within a business unit. Collect information in each department, then categorize the assets within each department
Horizontal Analysis
Prioritize the business units (departments) themselves; Steering committee collects the data but senior management makes the final prioritization
BCDR Testing Steps In Order with desc
- Checklist or Desk Check - give each dept a COPY of the PLAN and have them run through the checklist to make sure all relevant points are covered, check phone #, equipment locations, etc.
- Table-Top Review - Representatives get together in a meeting and review the plan collectively without actually performing the actions
- Structured Walk through - Team members physically walk to each location they will need to visit for response activities, then verbally review each step to assess its effectiveness. This will help identify flaws in the plan
- Simulation Test - Practice drill mobilizing the personnel. Done on simulated systems in a sandbox env in attempt to reach RTO
- Parallel test - Operational test at the alternate site running parallel to production
- Full Interruption - Shut down the production environment (home site) and run live environment at the alternate site
What do you need to have prior to running Full-Interruption step of BCDR testing?
- Written management approval
2. At least parallel testing beforehand (make sure alt site is operationally prepared)
Recovery in BCDR
RecOVERing an OPERATIONAL state as soon as possible once a disaster has been declared. Going OVER to the alternate site.
Restoration
Migrating the business back from recovery mode. Going back to the ORGINAL site.
Remember by restORation
What is the order of operations in Recovery vs Restoration
During the disaster, the MOST CRITICAL processes are recovered first
During the return to normal or restoration, the LEAST CRITICAL processes are sent back first
This is where the workbook stops and the book purchased begins
What should cloud customers ensure of all assets in their BYOD infrastructure that access the cloud?
be protected with some form of anti-malware/security software
have remote wipe/remote lock capability in the event of loss/theft, with the user granting written permission to the organization to wipe/lock via a signed authorized use policy
utilize some form of local encryption
be secured with strong access controls (a password, or perhaps a biometric) in a multifactor configuration
have and properly employ VPN solutions for cloud access
have some sort of data loss, leak prevention, and protection (DLP) solution installed
consider containerization software options for personally owned user devices as a means to isolate their personal data from the organization’s information
What should encryption be utilized for in the cloud data center or when cloud providers and users are communicating?
In the cloud data center for:
- data at rest, which includes long-term storage/archiving/backups, protecting near-term stored files (such as snapshots of virtualized instances), preventing unauthorized access to specific datasets by authorized personnel (for instance,
- securing fields in databases so that database admins can manage software but not modify/view content);
-secure sanitization (cryptographic erasure/cryptoshredding)
In communications between cloud providers and users for:
creating secure sessions,
ensuring the integrity and confidentiality of data in transit
Layered Defense
AKA
Description
defense in depth
it is the practice of having multiple overlapping means of securing the environment with a variety of methods. These should include a blend of administrative, logical, technical, and physical controls.
From a cloud provider perspective, what should a layered defense should entail?
Strong personnel controls involving background checks and continual monitoring
Technological controls such as encryption, event logging, and access control enforcement
Physical controls related to both the overall campus, the various facilities, the areas within the data center where data is processed and stored, individual racks and particular devices, and portable media entering and leaving the campus
Governance mechanisms and enforcement, such as strong policies and regular, thorough audits
From a cloud customer perspective, what should a layered defense should entail?
Training programs for staff and users that include good coverage of security topics
Contractual enforcement of policy requirements
Use of encryption and logical isolation mechanisms on BYOD assets
Strong remote access control methods, perhaps including multifactor authentication
Cloud Planning
- Screen Applications for Cloud feasibility and benefits
- Identify candidate applications for the cloud
- Describe characteristics of each candidate application
- Document current infrastructure implementation
- Determine organization constraints
- Identify the best candidate for cloud migration
- Plan cloud migration
- Realize capacity requirements in the cloud
- Compare and select cloud providers
- Perform ROI analysis
- Generate migration roadmap
