Business Continuity & Crisis Management in the Cyberbreach Age

Business Continuity & Crisis Management
in the Cyberbreach Age
Bryan Strawser, MBCP, MBCI, CISSP, CEM
Principal Consultant & CEO

Data Breaches
Company Impacted People
Sony Pictures 6,000
Sally Beauty 25,000
Neiman Marcus 1,100,000
Michaels Stores 3,000,000
Community Health Systems 4,500,000
PF Chang’s 7,000,000
Home Depot 56,000,000
Target 70,000,000
JP Morgan 76,000,000
Anthem 80,000,000
eBay 145,000,000
7
The Last 36 Months
Copyright © 2015 by Bryghtpath LLC | bryghtpath.com | +1-612-235-6435 | bryan@bryghtpath.com

Today
• Continuity of Operations
• Crisis / Emergency Management
• Crisis Communications
• Where to learn more…
• Q&A
13
Key Topics

Continuity of Operations
The ability to continue performance
of mission essential functions under a
broad range of circumstances
14
An Overview

Continuity of Operations
• Mission Essential Functions (MEFs)
– Critical functions performed by your agency
– Determined through a methodology
– Plans are in place to recover from a disruption
• Broad Range of Circumstances
– “All-Hazards” approach
– Plans (Annexes) for specific circumstances
15
What it means

Global Standards
US Government
• FEMA Federal Continuity Directives (FCD 1 / FCD 2)
• FEMA Continuity Guidance Circulars (CGC 1 / CGC 2)
• NIST 800-34, Contingency Planning Guide for Federal Information Systems
Business Continuity
• ISO 22301 (formerly BS25999)
• NFPA 1600
• ASIS Business Continuity Management Standard
• ASIS SPC.1: Organizational Resilience
Professional Practices
• Disaster Recovery Institute International BC/DR Professional Practices
• Business Continuity Institute Good Practice Guide
16
Business Continuity and Emergency Management

• Federal guidance for non-
Federal governmental
entities
• Contents:
– Planning and implementing
a COOP program
– Continuity planning for
mission essential functions
17
FEMA Continuity Guidance Circular 1 (CGC 1)
Continuity of Operations Program for State / Local / Tribal Government

• Federal guidance for non-
Federal governmental
entities
• Contents:
– Identification and
prioritization of Mission
Essential Functions (MEF)
– Business Process Analysis
– Business Impact Analysis
– Risk Assessment
18
Continuity of Operations Program for State / Local / Tribal Government

Business Continuity Regulations
United States
• Federal Financial Institutions Examination Council (FFIEC)
• Securities and Exchange Commission (SEC)
• Financial Industry Regulatory Authority (FINRA)
• Payment Card Industry Standard (PCI)
19
We’re from the government, we’re here to help…

20
Continuity of Operations Lifecycle
Plans and
Procedures
Test, Training, &
Exercises
Evaluations, After-
Action Reports,
and Lessons
Learned
Develop Corrective
Action Plans

Business Impact Analysis & Risk Assessment
Identifying critical business functions & their risks
Business Impact Analysis
• What are the mission essential functions at
my agency?
• How long can they be disrupted?
• How quickly can they be recovered today?
• What is the impact from that disruption to
my agency?
• BIA Methods
Risk Assessment
• What are the risks to these functions?
• What are our top enterprise risks?
• Risk Assessment Methods
Third Parties
• Don’t forget about them…

Specific actions to manage
your risks and address your
opportunities
• Prepare your agency for
disruption
• Develop COOP Plans
• Implement COOP
Solutions
22
Plans and Procedures
How can I recover my mission essential functions in the time period needed?

Core Components of a COOP Plan
• Roles & Responsibilities
• Activation process
• Managing the immediate
consequences
• Communication plan
• Recover prioritized activities
• Media response
• Process for standing down
23
Plans and Procedures
Continuity of Operations Planning

• People
– Who will do the work?
• Technologies
– What, if any, technologies will
enable the work?
• Facilities
– Where will the work be done?
• Communications
– How do we share this
information?
24
Core Plan Elements
Recovering Operations

25
Establish & Implement BC Procedures
What processes will I follow in a disruption?
Specific defined processes for
Business Continuity
Examples:
• Emergency preparedness
• Governance
• Activation

• “Disaster Recovery”
generally pertains to the
recoverability of IT systems
– Applications
– Infrastructure
• Must be closely linked to
business continuity
capability
• Should heavily utilize the
BIA findings to influence a
tiered recovery strategy
26
Disaster Recovery
Business Continuity for IT Systems

• All plans should be exercised
at least annually:
– Notification
– Table Top
– Recovery
– Fully integrated
• Disaster Recovery
– Testing DR plans and strategies
• Government Guidance:
– Homeland Security Exercise &
Evaluation Program (HSEEP)
27
Tests, Training, and Exercises
How will I exercise and test my plans? Based on those results, how will I improve?

• Defined process for
capturing lessons learned
and applying to plans and
strategies
• Action items tracked and
reported upon to key
stakeholders and leaders
28
Develop Corrective Action Plans
Improving plans and procedures following a test or exercise

29
Continuity of Operations Lifecycle
Plans and
Procedures
Test, Training, &
Exercises
Evaluations,
After-Action
Reports, and
Lessons Learned
Develop
Corrective Action
Plans

30
Continuity Plan Operational Phases
What happens when things go bad?
Readiness &
Preparedness
Activation
Continuity
Operations
Reconstitution

Roles and Responsibilities
3
Who does what?
• Elected Officials
– Ultimately responsible for continuity of essential functions during a
disruption or emergency
• Senior Leadership
– Designates Continuity Manager and Planning Team
– Approves plans
• Continuity Manager
– Responsible for coordinating all continuity activities within an agency
• Continuity Planning Team
– Cross functional group that coordinates all plans within an agency

32
Drip, Drip…
When a drip becomes a flood…

• 2013 Target
Corporation HQ Flood
• Read PDF Case Study
at bryghtpath.com
33
Case Study
When a drip becomes a flood…

3

Crisis Management
The active management of a disruption or escalating situation
Items to consider:
• Clear roles and responsibilities
• Decision making rights pre-defined
• Single source of truth communication
• Communication products / messages
• Cross-functional coordination
A Component of Business Continuity Management

Crisis Leadership
3
Characteristics of a strong crisis leader
• Cross-Functional Leadership
– Lead up (vertically)
– Lead across (horizontally)
• Be both strategic and tactical
– Strategic: See the entire organization and external influences
– Tactical: Be willing to work on really simple processes where
needed
• Understands that success never happens within a silo
• Doesn’t try to get “fancy”
• Can pivot in a moment
• Possesses extraordinary situational awareness

Private Sector Crisis Management Framework
3
Situational Awareness
Executive Crisis Team
(Elected Leaders / Senior Leader)
Cross-Functional Crisis Team
(Mission Essential Leaders)
Crisis Management Team
Strategic Decision Making
Day to day operations
Recommendations to Executives
Horizontal Communication
Subject matter experts
Situational awareness upstream
Full-time / volunteer

Planning & Preparedness
3
Routine v. Novel
• Don’t get fancy at first
– How will the team “activate” and share that they are
actively managing a situation?
– How will they provide updates?
– What decisions will be escalated to executives?
• Then get fancy
– What could disrupt our business?
– Prioritize these risks with executives
– Plan for key risks
• REMEMBER: You cannot plan for everything
• Having a framework is more important than having a
plan for every single possibility

39
Case Study: Earthquake & Tsunami – Sendai, Japan (2011)

Crisis Management Framework
4
Routine Incident
HOLY S$@!
What just happened?!
Protocols & Processes
Incident Specific Plans
Preparedness Steps
Collaborative cross-
functional discussion
Strategic view
Framework for
collaborative decision
making & communication

Crisis Leadership
4
• What’s happening?
• What do we know about it?
• What impact is it having on our organization?
• What don’t we know what we need to know?

Practical Advice
4
The Simple Things
• Work / Organization
– Clear roles & responsibilities
– Establish decision making rights
– How will you communicate?
– Situational Awareness
• Personal
– Be Informed
– Make a Plan
– Build a Kit
– Visit ready.gov for more practical advice

Reputation Impact
Hurricane Sandy - 2012
International Business Times –11/3

Crisis Communications
4
Sending out a press release isn’t going to cut it
• You’ll only get one chance to message things with your
version of the story – don’t pass up this opportunity!
• Slow, methodical PR planning will not suffice –
communications must be nimble.
• Speed, accuracy, clarity will be critical in a data breach
• Honesty – spin is ok, but be honest.
• Cultural context is critical.

How to Lead during a crisis
5
Eric McNulty, Harvard Business Review, December 2013
• Ensure certainty about decision making and
strategic messaging
• Understand Stakeholders
– Map out your stakeholders
– Understand each has unique needs for information and
reassurance
– Develop story arcs for each
• Understand that the crisis will evolve over time

Continuity of Operations Training
53
FEMA Emergency Management Institute
• Free FEMA Independent Study
courses online
• http://training.fema.gov/EMI

Continuity of Operations Certifications
54
FEMA Emergency Management Institute
• FEMA Continuity of Operations (COOP) Certifications
• Level 1: Professional Continuity Practitioner
• Series of 13 independent study or in-person courses
• Many in-person courses can be taken through MN Homeland Security &
Emergency Management for free
• Level 2: Master Continuity Practitioner
• Complete Level 1 certification
• Complete 5 additional independent study and in-person courses
• Instruct one continuity course as an instructor
• Complete and pass comprehensive written examination
• Learn more at http://training.fema.gov/programs/COOP

Industry Professional Certifications
Business Continuity
• Disaster Recovery Institute International
– Associate Business Continuity Professional (ABCP)
– Certified Business Continuity Professional (CBCP)
– Master Business Continuity Professional (MBCP)
• Business Continuity Institute
– Member, Business Continuity Institute (MBCI)
– Fellow, Business Continuity Institute (FBCI)
Emergency Management
• International Association of Emergency Managers
– Associate Emergency Manager (AEM)
– Certified Emergency Manager (CEM)
55
Business Continuity and Emergency Management

Contact Information
Contact Bryan:
Bryan Strawser
Principal Consultant & CEO
Phone: +1-612-235-6435
E-Mail: bryan@bryghtpath.com
Twitter: @bryanstrawser
Learn more about Bryghtpath LLC
Website: www.bryghtpath.com
Twitter: @bryghtpath
Facebook: /bryghtpathllc
56
Bryghtpath LLC
Our Consulting Services Include:
Business Continuity
Crisis / Emergency Management
Enterprise Risk Management
Exercise Design & Facilitation
Global Intelligence & Security
ISO Training & Certification
Project & Program Management
Travel Risk & Security

Business Continuity & Crisis Management in the Cyberbreach Age

Recommandé

Recommandé

Contenu connexe

Similaire à Business Continuity & Crisis Management in the Cyberbreach Age

Similaire à Business Continuity & Crisis Management in the Cyberbreach Age (20)

Plus de Bryghtpath LLC

Plus de Bryghtpath LLC (9)

Dernier

Dernier (15)

Business Continuity & Crisis Management in the Cyberbreach Age