Title: Continuity Strategies
Course: IN 2001 Principle of Information Assurance > Section: Module 5: Chapter Five

Continuity Strategies
1. Managers in the IT and information security communities are called on to provide strategic planning to assure the continuous availability of information systems.
2. Plans for events of this type such as:
  - Incident response plans (IRPs)
  - Disaster recovery plans (DRPs)
  - Business continuity plans (BCPs)
3. In large, complex organizations, each of these plans may represent separate but related planning functions that differ in scope, applicability and design.
4. In small organizations, the security or systems administrator may have one simple plan, which consists of a straightforward set of media backup and recovery strategies and a few service agreements from the company’s service providers.
5. Many organizations have a level of planning that is woefully deficient.
6. We can classify incident response, disaster recovery and business continuity planning as components of contingency planning.
7. Contingency planning (CP), which is conducted by the organization to prepare for, react to and recover from events that threaten the security of information and information assets in the organization.
8. An incident is any clearly identified attack on the organization’s information assets that would threaten the assets’ confidentiality, integrity or availability.
9. Incident response planning (IRP), which deals with the identification, classification, response and recovery from an incident.
10. Disaster recovery planning (DRP) deals with the preparation for and recovery from a disaster, whether natural or man-made.
11. Business continuity planning (BCP) ensures that critical business functions continue if a catastrophic incident or disaster occurs.
12. The primary functions of these three types of planning:
  - The IRP focuses on immediate response, but if the attack escalates or is disastrous, the process changes to disaster recovery and BCP
  - The DRP typically focuses on restoring systems after disasters occur and is closely associated with BCP
13. The BCP occurs concurrently with the DRP when the damage is major or long term, requiring more than simple restoration of information and information resources.
14. Some experts argue that the DR and BC plans are so closely linked that they are indistinguishable (they use the term business resumption planning).  However, each has a distinct role and planning requirement.
15. Before any planning can begin, an assigned person or a planning team has to get the process started. Usually, a contingency planning team is assembled for that purpose.  A roster for this team may consist of the following members:
  - Champion: A high-level manager who supports, promotes, and endorses the findings of the project
  - Project manager: Leads the project and makes sure a sound project planning process is used, a complete and useful project plan is developed, and project resources are prudently managed
  - Team members: Managers or their representatives from the various communities of interest: business, IT and information security.

Business Impact Analysis
1. The first phase in the development of the CP process, which is the business impact analysis or BIA. A BIA is an investigation and assessment of the impact that various attacks can have on the organization and it continues where the risk assessment process leaves off.
2. The BIA assumes that protective controls have been bypassed, have failed or are otherwise ineffective in stopping the attack, and that the attack was successful.  The question asked at this point is, if the attack succeeds, what do we do then?
3. The states that the CP team uses to conduct the BIA:
  - Threat attack identification and prioritization
  - Business unit analysis
  - Attack success scenario development
  - Potential damage assessment
  - Subordinate plan classification
4. Threat attack identification and prioritization
  - Most organizations have already performed the tasks of identifying and prioritizing threats during risk assessment. All that is required now is to update the threat list with the latest developments and add one additional piece of information, the attack profile
  - An attack profile is a detailed description of the activities that occur during an attack.  An attack profile must be developed for every serious threat the organization faces, as it is used to determine the extent of damage that could result to a business unit if a given attack was successful
5. Business unit analysis.
  - The second major task within the BIA is the analysis and prioritization of business functions within the organization.  This task identifies the functional areas of the organization and prioritizes them to determine which are most vital to the continued operations of the organization
  - Efforts in function analysis focus on producing a prioritized list of the various functions the organization performs
6. An attack success scenario development.
7. ·         Next, the BIA team must create a series of scenarios that depict the impact a successful attack could have on each prioritized functional area. They must include details on the method of attack, the indicators of attack, and the broad consequences of the attack.
8. ·         Attack success scenarios with more detail are then added to the attack profile, including alternate outcomes. These outcomes describe a best, worst, and most likely case that could result from each type of attack on this particular business functional area.
9. Potential damage assessment.
  - From the attack success scenarios developed above, the BIA planning team must estimate the cost of the best, worst, and most likely cases
  - These costs include the actions of the response team(s), which are described in subsequent sections, as they act to quickly and effectively recover from any incident or disaster.  These costs can also inform management representatives from all of the organization’s communities of interest of the importance of the planning and recovery efforts.  The final result is referred to as an attack scenario end case.
10. Concept of subordinate plan classification.
  - Once the potential damage has been assessed and each end case has been evaluated, a subordinate plan must be developed or identified from among existing plans already in place
11. These subordinate plans will take into account the identification of, reaction to and recovery from each attack scenario.  An attack scenario end case is categorized as disastrous or not.  The qualifying difference is whether or not an organization is able to take effective action during the event to combat the effect of the attack.

Incident Response Planning
1. Incident response planning deals with the identification of, classification of and response to an incident.
2. IRP is made up of activities that are performed when an incident has been identified.  An incident is an attack against an information asset that poses a clear threat to the confidentiality, integrity or availability of information resources.
3. Attacks are only classified as incidents if they have the following characteristics:
  - They are directed against information assets
  - They have a realistic chance of success
  - They could threaten the confidentiality, integrity or availability of information resources
4. Incident response (IR) is the set of activities taken to plan for, detect, and correct the impact of an incident on information resources.  IR is more reactive than proactive, with the exception of the planning that must occur to prepare the IR teams to be ready to react to an incident.  IR consists of the following four phases:
  - Planning
  - Detection
  - Reaction
  - Recovery
5. Incident planning
  - Planning for an incident requires a detailed understanding of the scenarios developed for the BIA.  Predefined responses enable the organization to react quickly and effectively to the detected incident . This assumes two things:
    - The organization has an IR team
    - The organization can detect the incident
  - The IR team consists of those individuals who must be present to handle the systems and functional areas that can minimize the impact of an incident as it takes place.  The designated IR teams act to verify the threat, determine the appropriate response and coordinate the actions necessary to deal with the situation
6. Incident response plan.
  - Planners should develop a set of documents that guide the actions of each involved individual who reacts to and recovers from the incident
  - These plans must be properly organized and stored to be available when and where needed and in a useful format
7. The format and content of an IR plan.
  - The IR plan must be organized in such a way as to support quick and easy access to required information
  - This can be accomplished through a number of measures, the simplest of which is to create a directory of incidents with a tabbed section for each incident
  - When an individual needs to respond to an incident, he or she simply opens the binder, flips to the appropriate section and follows the clearly outlined procedures for an assigned role
8. Storage.
  - The information in the IR plan should be protected as sensitive information
  - If attackers know how a company responds to a particular incident, it could improve their chances of making the attack successful
  - On the other hand, the organization needs this information readily available, usually within reach of the information assets that must be manipulated during or immediately after the attack
  - The bottom line is that individuals who respond to the incident should not have to search frantically for needed information, especially under stress
9. The purpose and type of testing.
  - A plan untested is not a useful plan. The following are five types of testing strategies:
    - Checklist: Copies of the IR plan are distributed and reviewed by each individual with a role to play during an actual incident
    - Structured walk-through: Each involved individual practices the steps he or she will take during an actual event
    - Simulation: Each involved person works individually, simulating the performance of each task required to react to and recover from a simulated incident
    - Parallel: Individuals act as if an actual incident occurred, performing their required tasks and executing the necessary procedures.  Normal operations of the business do not stop
    - Full interruption: Employees react to a mock incident as if it were real.  Individuals follow each and every procedure, including the interruption of service, restoration of data from backups and notification of appropriate individuals
10. Incident detection.
  - Individuals sometimes notify systems administrators, security administrators or their managers of an unusual occurrence.  The most common occurrence is a complaint about technology support, which is often delivered to the help desk
  - The mechanisms that could potentially detect an incident include host-based and network-based intrusion detection systems, virus detection software, systems administrators, and even end users
  - Only by carefully training the user, the help desk and all security personnel on the analysis and identification of attacks can the organization hope to quickly identify and classify an incident.
  - Once an attack is properly identified, the organization can effectively execute the corresponding procedures from the IR plan
  - Incident classification is the process of examining a potential incident or incident candidate and determining whether or not the candidate constitutes an actual incident
11. Incident indicators.
  - A number of occurrences could signal the presence of an incident candidate
  - Possible indicators of incidents:
    - Presence of unfamiliar files
    - Presence or execution of unknown programs or processes
    - Unusual consumption of computing resources
    - Unusual system crashes
  - Probable indicators of incidents:
    - Activities at unexpected times
    - Presence of new accounts
    - Reported attacks
    - Notifications from IDS
  - Definite indicators of incidents:
    - Use of dormant accounts
    - Changes to logs
    - Presence of hacker tools
    - Notifications by partner or peer
    - Notifications by hacker
  - Predefined situations that signal an automatic incident:
    - Loss of availability
    - Loss of integrity
    - Loss of confidentiality
    - Violation of policy
    - Violation of law
12. Incident reaction.
  - Incident reaction consists of actions outlined in the IR plan that guide the organization in attempting to stop the incident, mitigate the impact of the incident and provide information for recovery from the incident
  - In reacting to the incident, there are a number of actions that must occur quickly, including notification of key personnel and documentation of the incident.  These should be prioritized and documented in the IR plan for quick use
  - Notification of key personnel
  - Most organizations maintain alert rosters for emergencies.  An alert roster contains contact information for the individuals who should be notified in an incident.  There are two types of alert rosters: sequential and hierarchical
  - A sequential roster is activated as a contact person calls each and every person on the roster.
  - A hierarchical roster is activated as the first person calls a few other people on the roster, who, in turn, call a few other people and so on.
  - The alert message is a scripted description of the incident and includes just enough information so that everyone knows what part of the IRP to implement without slowing down the notification process.
  - There are other personnel who may also need to be notified but may not be part of the scripted alert notification process, because they are not needed until preliminary information has been collected and analyzed
13. How to document an incident.
  - Documenting the event is important.  First, it is important to ensure that the event is recorded for the organization’s records in order to know what happened, how it happened and what actions were taken.  The documentation should record the who, what, when, where, why and how of the event
  - Second, it is important to prove, should it ever be questioned, that the organization did everything possible to prevent the spread of the incident.  The recorded incident can also be used as a simulation in future training sessions.
14. Incident Containment Strategies.
  - One of the most critical components of incident reaction is to stop the incident or contain its scope or impact.  However, sometimes situations prevent the most direct measures associated with simply “cutting the wire”
  - Before an incident can be contained, the affected areas of the information and information systems must be determined.  In general, incident containment strategies focus on two tasks: stopping the incident and recovering control of the systems.  The organization can stop the incident and attempt to recover control through a number of strategies. If the incident:
    - Originates outside the organization, the simplest and most straightforward approach is to sever the affected circuits
    - Uses compromised accounts, the accounts can be disabled
    - Comes in through a firewall, the firewall can be reconfigured to block that particular traffic
    - Uses a particular service or process, that process or service can be disabled temporarily
    - Uses the organization’s systems to propagate itself, you can take down that particular application or server (e-mail for example)
    - The ultimate containment option, reserved for only the most drastic of scenarios, involves a full stop of all computers and network devices in the organization
    - The bottom line is that containment consists of isolating the channels, processes, services or computers and removing the losses from that source of the incident
15. Incident Recovery.
  - Once the incident has been contained and control of the systems has been regained, the next stage is recovery
  - As with reaction to the incident, the first task is to identify the human resources needed for the recovery and launch them into action.  The full extent of the damage must be assessed
  - The process of computer forensics entails determining how the incident occurred and what happened.
  - The organization repairs vulnerabilities, addresses any shortcomings in safeguards and restores the data and services of the systems
16. Prioritization of efforts.
  - To recover from the incident, people must stay focused on the task ahead and make sure that necessary personnel begin recovery operations as per the IR plan
17. Damage assessment.
  - Incident damage assessment determines the scope of the breach of the confidentiality, integrity and availability of information and information assets during or just after an incident
  - Several sources provide information on the type, scope, and extent of damage, including system logs, intrusion detection logs, configuration logs and documents, the documentation from the incident response and the results of a detailed assessment of systems and data storage.  Using these logs and documentation as a basis for comparison, the IR team can evaluate the current state of the information and systems
  - Related to the task of incident damage assessment is the field of computer forensics. Computer forensics is the process of collecting, analyzing, and preserving computer-related evidence.  Evidence is a physical object or documented information that proves an action occurred or identifies the intent of a perpetrator.  Computer evidence must be carefully collected, documented, and maintained to be acceptable in formal or informal proceedings
  - Circumstances require that individuals who look for the damage receive special training, so that if the incident is part of a crime or results in a civil action, the individuals are adequately prepared to participate
18. Recovery procedures.
  - The recovery process involves the following steps:
    - Identify the vulnerabilities that allowed the incident to occur and spread and resolve them
    - Address the safeguards that failed to stop or limit the incident or were missing from the system in the first place.  Install replace, or upgrade them
    - Evaluate monitoring capabilities.  Improve their detection and reporting methods, or simply install new monitoring capabilities
    - Restore the data from backups
    - Restore the services and processes in use
    - Continuously monitor the system
    - Restore the confidence of the organization’s communities of interest
    - Before returning to routine duties, the IR team must conduct an after-action review or AAR.  The after-action review is a detailed examination of the events that occurred from first detection to final recovery.  This review allows the team to update the IR plan while events are fresh in their minds.  The AAR is documented and can serve as a training case for future staff
19. Automated response systems.
  - Although traditional systems were configured to detect incidents and then notify a human administrator, new systems can respond to the incident threat autonomously, based on preconfigured options
  - The downsides of current automated response systems may outweigh their benefits. Legal issues with tracking individuals via the systems of others have yet to be resolved

Disaster Recovery Planning
1. An event can be categorized as a disaster when the following happens:
  - The organization is unable to mitigate the impact of an incident during the incident
  - The level of damage or destruction is so severe that the organization is unable to recover quickly
2. The contingency planning team must decide which actions constitute disasters and which constitute incidents.
3. At the time that a decision is made and the situation is classified as a disaster, the organization may change how it is responding and take action to secure its most valuable assets to preserve value for the longer term, even at the risk of more disruption in the immediate term.
4. Disaster recovery planning (DRP) is the preparation for and recovery from a disaster, whether natural or man-made.  The key emphasis of a DRP is to reestablish operations at the primary site, the location at which the organization performs its business.  The goal is to make things “whole” or as they were before the disaster.
5. Disaster recovery plans.
  - Similar in structure to the IR plan, the DR plan provides detailed guidance in the event of a disaster. Many of the same precepts of incident response apply to disaster recovery:
    - There must be a clear establishment of priorities
    - There must be a clear delegation of roles and responsibilities
    - Someone must initiate the alert roster and notify key personnel
    - Someone must be tasked with the documentation of the disaster
    - If and only if it is possible, some attempts must be made to mitigate the impact of the disaster on the operations of the organization
6. Recovery operations.
  - Reaction to a disaster can vary widely, so each organization must examine the scenarios developed at the start of contingency planning and determine how to respond.  When a disaster threatens the organization’s viability at the primary site, the disaster recovery process transitions into the process of business continuity planning

Business Continuity Planning
1. Business continuity planning outlines the reestablishment of critical business operations during a disaster that impacts operations at the primary site.
2. If a disaster has rendered the current location of the business unusable for continued operations, there must be a plan to allow the business to continue to function.
3. Developing continuity programs.
  - Once the incident response plans and disaster recovery plans are in place, the organization needs to address the possibility of finding temporary facilities to support the continued viability of the business
  - The BCP consists primarily of selecting a continuity strategy and integrating the off-site data storage and recovery functions into this strategy
  - The first part of the BCP is performed when the joint DRP/BCP plan is developed.  The cornerstone of the BCP is the identification of critical business functions and the resources needed to support them
  - The contingency planning team needs to appoint a team to evaluate and compare the various alternatives available, and recommend which strategy should be selected and implemented.  The selected strategy usually involves some form of off-site facility, which should be inspected, configured, secured and tested on a periodic basis.
4. Continuity strategies.
  - There are a number of strategies that an organization can choose from when planning for business continuity
  - The determining factor in the selection of an option is usually cost.  In general, there are three exclusive options:
    - Hot sites
    - Warm sites
    - Cold sites
  - There are three shared functions:
    - Time-share
    - Service bureaus
    - Mutual agreements
  - There are some specialized alternatives available, such as a rolling mobile site configured in the payload area of a tractor trailer or externally stored resources
5. Off-site disaster data storage.
  - To get these types of sites up and running quickly, the organization must have the ability to port data into the new site’s systems
  - There are a number of options for getting operations up and running quickly and some of these options can be used for purposes other than the restoration of continuity
  - These include:
    - Electronic vaulting: The transfer of large batches of data to an off-site facility
    - Remote journaling: The transfer of live transactions to an off-site facility; the transfer is in real-time, and archived data is not transferred
    - Database shadowing: Not only processes duplicate, real-time data storage, but also duplicates the databases at the remote site to multiple servers

Crisis Management
1. Disasters are larger in scale and less manageable than incidents, but the planning processes are the same and in many cases are conducted simultaneously.
2. A disaster recovery team may not have the luxury of flipping through a binder to see what must be done. Disaster recovery personnel must know their roles without any supporting documentation.  This is a function of preparation, training and rehearsal.
3. The actions taken during and after a disaster are referred to as crisis management.  Crisis management differs dramatically from incident response, as it focuses first and foremost on the people involved.  The disaster recovery team works closely with the crisis management team.
4. The crisis management team is responsible for managing the event from an enterprise perspective and covers:
  - Supporting personnel and their loved ones during the crisis
  - Determining the event's impact on normal business operations and, if necessary, making a disaster declaration
  - Keeping the public informed about the event and the actions being taken to ensure the recovery of personnel and the enterprise
  - Communicating with major customers, suppliers, partners, regulatory agencies, industry organizations, the media and other interested parties
5. The crisis management team should establish a base of operations or a command center to support communications until the disaster has ended.  The team includes individuals from all functional areas of the organization to facilitate communications and cooperation.  Some key areas of crisis management include:
  - Verifying personnel head count
  - Checking the alert roster
  - Checking emergency information cards
6. Crisis management must balance the needs of the employees with the needs of the business in providing personnel with support for personal and family issues during disasters.

Model for a Consolidated Contingency Plan
1. The single document set approach supports concise planning and encourages smaller organizations to develop, test and use IR and DR plans.
2. The model presented is based on the analyses of disaster recovery and incident response plans of dozens of organizations.
3. The planning document.
  - The first task is to establish the responsibility for managing the document, which typically falls to the security administrator.  A secretary is appointed to document the activities and results of the planning session
  - First, independent incident response and disaster recovery teams are formed.  Next, the roles and responsibilities are outlined for each team member.  The alert roster is developed, as are lists of critical agencies. Next, the group identifies and prioritizes threats to the organization’s information and information systems
  - There are six steps in the consolidated contingency planning process:
    - 1)    Identify the mission- or business-critical functions
    - 2)    Identify the resources that support the critical functions
    - 3)    Anticipate potential contingencies or disasters
    - 4)    Select contingency planning strategies
    - 5)    Implement the contingency strategies
    - 6)    Test and revise the strategy

Law Enforcement Involvement

1. There may come a time when an incident constitutes a violation of law.
2. The organization may determine that involving law enforcement is necessary.
3. Several questions that must then be answered:
  - When should the organization get law enforcement involved?
  - What level of law enforcement agency should be involved: local, state or federal?
  - What will happen when the law enforcement agency is involved?
4. Some of these questions are best answered by the organization’s legal department.
5. The federal authorities involved in these processes.
  - Selecting the level of law enforcement to involve depends in part on the level and type of crime discovered
  - The Federal Bureau of Investigation deals with many computer crimes that are categorized as felonies
  - The U.S. Secret Service works with crimes involving U.S. currency, counterfeiting, credit cards, identity theft and other crimes
  - The U.S. Treasury Department has a bank fraud investigation unit and the Securities and Exchange Commission has investigation and fraud control units as well
  - However, because of the heavy load of cases these agencies must handle, they typically give priority to incidents that affect the national critical infrastructure or that have significant economic impact
  - If the crime is not directed at or does not affect the national infrastructure, the FBI may not be able to assist as effectively as state or local agencies
  - As a rule of thumb, if the crime crosses state lines, it is a federal matter
  - The FBI may also become involved at the request of a state agency, if it has available personnel
6. The role of state investigative services.
  - Each state has its own version of the FBI. In Georgia, it is called the Georgia Bureau of Investigation. The GBI arrests individuals, serves warrants, and generally enforces laws on property that is owned by the state or any state agency
  - The state investigative office may not have a special agency dedicated to computer crime. However, if there is a law within the state that impacts computer crimes, the state agency handles the case
7. The role of local law enforcement.
  - Local agencies enforce all local and state laws and handle suspects and security crime scenes for state and federal cases
  - Local law enforcement agencies seldom have a computer crimes task force, but the investigative (detective) units are quite capable of processing crime scenes and handling most of the common criminal activities, such as physical theft or trespassing, damage to property and the apprehension and processing of suspects of computer-related crimes
8. The benefits and drawbacks of law enforcement involvement.
  - Involving law enforcement agencies has both advantages and disadvantages
  - The agencies may be much better equipped at processing evidence than a particular organization.  Unless the security forces in the organization have been trained in processing evidence and computer forensics, they may do more harm than good in extracting the necessary information to legally convict a suspected criminal
  - Law enforcement agencies can also issue the warrants and subpoenas necessary to document a case. They are also adept at obtaining statements from witnesses, affidavits, and other required documents
  - Law enforcement personnel can be a security administrator’s greatest ally in the war on computer crime.  It is, therefore, important to get to know your local and state counterparts before you have to make a call announcing a suspected crime
  - On the downside, once a law enforcement agency takes over a case, the organization loses complete control over the chain of events, the collection of information and evidence, and the prosecution of suspects
  - An individual the organization may wish only to censure and dismiss may face criminal charges when the intricate details of his or her crimes become matters of public record
  - The organization may not hear about the case for weeks or even months.  Equipment vital to the organization’s business may be tagged as evidence to be removed, stored and preserved until it can be examined for possible support for the criminal case.
  - If, however, the organization detects a criminal act, it has a legal obligation to involve the appropriate law enforcement officials.  Failure to do so can subject the organization and its officers to prosecution as accessories to the crimes, or as impeding the course of an investigation