Business Continuity Planning (BCP)– Essential Steps

Disaster can happen anytime to any strong setup. The best way to provide stability is by establishing mechanisms to provide continuity to all critical Operations. This can be achieved by a proper Business Continuity Plan (BCP). Business Continuity Planning is not only very important for CISA examination but equally important for Information Systems/Information Security setup. It is very critical to identify all critical process. Criticality ranking is required.Recovery Process needs to be established and a proper testing system is to be devised.
Following are the essential steps in designing a successful BCP.

1. Business Impact Analysis

In the first phase we define all the critical resources which includes critical procedures, critical process and all the critical people. Remember processes connect procedures and people. Their impact analysis is studied individually and in overall system.

Business Impact analysis involves:

i. Criticality definition
ii. Criticality identification
iii.Individual/Overall Criticality impact
iv.Criticality Ranking.

2. Strategies for recovery

Recovery process are designed which helps in identification, declaration and restoration of important critical resources. Recovery Strategies needs to be devised for :

i. Identification of disaster
ii. Declaration of Disaster
iii.Various Teams development
iv.Backup Planning
v. Restoration Planning
vi.Resource allocation


3. Testing of BCP

Testing can be of following types:

i. Paper test
ii. Full test

Depending upon architecture of the Information System Testing mechanism should be adopted. Ideal situation will be a paper test followed by Full test. For the full test a replica of main setup is needed as Disaster recovery setup.

4.Documentation

All of the above steps should be well documented, tested and approved.

5.Involvement of top Management

In my view this is the most crucial step for a successful BCP.

6.Periodic review

Periodic review is very important. BCP should also be reviewed when there is a major change in Information System.

Read More......

Backup and Recovery Planning

Important job of an Information Security Professionals and IS Auditor is to ensure/check whether the existing backup policies are capable of supporting adequate data recovery in the case of a disaster. A capable backup and Recovery system requires a proper planning and considerations in the in the initial stages of Backup and Recovery System Development.

A backup and recovery system should be designed by considering following facts:

1. Nature of the Information System

Nature of the system largely decides the way backup and recovery required. System could be of following types:

Online Vs Offline System

OLTP Vs OLAP System

Financial Vs Non Financial System etc.

For example, an online system does not require traditional way of a backup as needed for many of offline systems. Online Transaction Processing (OLTP) system backup will be relatively smaller in size as compared to Online Analytical Processing (OLAP) systems. Backup of the financial system should involve a lot of logs as compared to Non financial system.

2. What to backup

What to backup is primarily dependent on nature of Information System? Broadly following elements should be the member of backup set.

System log

Application log

Data Files

Transaction and master files

Compiled Object and Source Code

Network logs

3. How to backup

This depends on the requirement and the available resources. An Information System should have one or more of the following backup systems.

Full Backup

Incremental Backup

Automated backup

Manual Backup

4. Periodicity and Timing of backup

Periodicity and timing of backup depends on the nature of Information system and requirements. For example we can not have offline backup or root backup during business hour. Periodicity is decided by amount and criticality of data. Where as online backup system is generally always on.

5. Where to backup

In present era we have a lot of options for backup. Following options can be used based on the need:

DAT Drive

DLT Tapes

Compact Disc (CD ROM/RW)

Digital Versatile Disc (DVD)

Secondary Sites

Near sites

6. Where to store

Backup can be stored in following major ways:

Onsite storage

Offsite storage

7. Recovery Arrangements

Following recovery arrangements can be made:

Hot Sites

Cold Sites

Alternate/Reciprocal arrangement

Warm sites

For details please, refer to Disaster Recovery Services for CISA Exam.

8. Division of labour

A backup tape librarian should be given only compatible jobs. For details please, refer to Segregation of duties from CISA Exam Point of View & More Segregation of duties for CISA Aspirants - job allocation for various Administrators.

9. Periodical Testing of Backup

This is the most important stage of any Backup and Recovery Plan.

10. Periodical Audit of Backup and Information System

This should also be considered in the design phase itself.

11. Documentation

A clear documented backup procedure manual should be prepared and available.

Summary:

Important points to remember about Backup and recovery System:

1. Backup should be properly labeled.
2. Retention period should be clearly mentioned
3. System log and application log should be separately stored
4. Periodic testing of backup data is most important part of a backup and recovery facilities.
5. Periodic audit of the Backup & Recovery System should be there.
6. Backup and Recovery Manual should be available.

This article is useful for CISA Preparation, IS Auditors & Information Security Professionals

Read More......

Important Backup Considerations for BCP for CISA Preparation

CISA Quick Tips 19:
Backup is very important for most of the business and thus for Business Continuity.

An IS auditor while auditing/evaluating the backup Policy should see:

1. What data is being backed up?
all critical data must be the part of backup.

2. How backup is being taken ?
Whether backup procedure is

a. manual

b. automatic

c. electronical

d. or a mixture of one or more than above

3. How backed up data is being stored ?

4. Where backed up data is being stored?

5. Recovery strategy

6. periodic testing

7. documentation

******Periodic testing / recovery and documentation are the
most important part of backup policy*******.

CISA Type Question 19.

While auditing a small firm with very valuable data an auditor finds following?

A. Firm is having remote backup strategy
B. Makes the copy of data when data is updated and then transmission is done
C. Restoration of data is faster.
D. Backup policy implementation is costlier as compared to normal tape backup.

The above Electronic strategy is generally known as

1. Electronic vouching
2. Electronic vaulting
3. Electronic updation and transmission
4. Electronic casing

Answer to CISA Type question 18.

While auditing the encryption policy the IS auditor should see where the encryption is being used, whether the purpose of encryption is malicious and current regulatory policy.
So, the correct answer is 4. All of the above

Read More......

Disaster Recovery Services for CISA Exam

CISA Quick Points 12 :

 

Disaster Recovery can be done in many ways. Three important concepts are Hot Site, Warm Site and Cold site. Other important services like reciprocal arrangements/IPF will be covered later.


The following diagram will clear your basic concepts of Hot Site, Warm Site and Cold site.



 















CISA Type Question 12:



A Hot Site is a fully configured Disaster Recover service which may not have

1. Hardware & Peripherals

2. System Software

3. Networking devices and communication components

4. All Documentation & Data backup




Answer to CISA Type Question 11.


IS Auditor should not leave the assignment in between but should try to obtain the additional evidence to make audit evidence sufficient. Audit evidence should always be relevant and sufficient.

So, the correct answer is

2.Auditor should try to obtain additional evidence



Further Reference:

1. CISA Review Manual by published ISACA

2. http://www.isaca.org

Read More......