Domain 2: Business Continuity, Disaster Recovery and Incident Response
These three plans keep an organisation running through disruption: incident response handles security events, business continuity keeps critical functions going, and disaster recovery restores IT systems.
Incident response terms
- Event: any observable occurrence in a system or network.
- Incident: an event that actually or potentially harms the confidentiality, integrity or availability of a system or its data.
- Breach: loss of control or unauthorised disclosure of information.
- Exploit: a particular attack that takes advantage of a vulnerability.
- Vulnerability: a weakness that could be exploited by a threat.
- Zero day: a vulnerability unknown to the vendor, so no patch exists yet.
- Intrusion: a security event in which an intruder gains, or attempts to gain, access without authorisation.
Incident response process
The NIST life cycle has four phases:
- Preparation: policy, an incident response team, tools, training and communication plans.
- Detection and analysis: monitor, identify incidents, assess scope and priority, and notify.
- Containment, eradication and recovery: limit the damage, remove the cause, restore systems.
- Post-incident activity: lessons learned, evidence retention, and improving the plan.
Incident response team
A team (often called a CSIRT) usually includes a representative of senior management, information security staff, IT and network experts, legal, communications or public relations, and human resources. Members should be trained and on call.
Business continuity
- Business continuity plan (BCP): how the organisation keeps critical business functions running during and after a disruption.
- Business impact analysis (BIA): identifies critical functions and the effect of losing them, and sets recovery priorities.
- Maximum tolerable downtime (MTD): the longest a function can be unavailable before the damage is unacceptable.
- Recovery time objective (RTO): the target time to restore a function; must be shorter than the MTD.
- Recovery point objective (RPO): the maximum acceptable data loss, measured in time (how far back the last good backup can be).
Business continuity plan contents
A list of the BCP team members, immediate response procedures and checklists, notification systems and call trees, guidance for management including escalation and authority, how and when to activate the plan, and contact numbers for critical partners.
Disaster recovery
The disaster recovery plan (DRP) restores IT and communications after a disaster. It is part of business continuity and focuses on the technology: restoring systems, data and infrastructure in priority order.
Recovery sites
| Site | Readiness | Cost |
|---|---|---|
| Hot site | fully equipped, data nearly current; ready in minutes to hours | highest |
| Warm site | equipment in place, data must be restored; ready in hours to days | medium |
| Cold site | space and power only; ready in weeks | lowest |
| Mirrored site | runs in parallel with live data; near-instant failover | very high |
Backup types
- Full backup: copies all data; slowest to make, fastest to restore.
- Incremental backup: copies changes since the last backup of any type; fast to make, slower to restore (needs the full plus every incremental).
- Differential backup: copies changes since the last full backup; restore needs only the full plus the latest differential.
Testing the plans
From least to most disruptive: checklist review, tabletop exercise (walk-through discussion), simulation, parallel test (recovery systems run alongside production), and full interruption test (production is shut down and the recovery site takes over).