BCP/DRP Quick Notes

March 22, 2017

In case you haven't studied the BCP/DRP section of your studies yet, here is some information that I sent to the folks on the newsletter: 

 

The topic of proper business continuity and disaster recovery planning is highly testable.  

Expect to be tested on the following

  • BCP process and steps (Not specifics, just the general flow)

  • Components of the Business Impact Analysis (ARO, MTTR, MTBF, SLE)

  • The idea that all stakeholders of a BCP should be involved in the planning

  • Business continuation strategies 

  • The importance of documentation 


Here are some important concepts to remember

  • The process of recovering an organization's critical business functions after a disaster is known as BCP

  • Dealing with a more immediate or specific emergency is known as DRP. 

  • Difference between BCP and DRP

    • BCP is more high-level than DRP.  DRP falls under the umbrella of BCP.  

    • "What if our main data center was destroyed by an earthquake, what do we do?" - That's BCP.

    • "What if our firewall failed at our main data center, what do we do?" - That's DRP.  

  • The start of any organization's DRP/BCP program must have the approval of the senior management team 

    • Management's approval is also a show of their support 

  • BCP/DRP is all about documentation, documentation, documentation

    • According to the CISSP, the first thing to look for in a disaster is the proper documentation that contains procedures and guidelines on how to deal with a disaster 


Here are some types of disasters

  • Man-made

    • Negligence

    • Warfare

    • Fires

    • Terrorism

    • Insider threat

    • Cyber attack

  • Natural

    • Flood

    • Earthquake

    • Tornado

    • Tsunami 

The basic steps of a sound BCP are

  • Phase 1: Scope and Initiation 

  • Phase 2: Business Impact Analysis 

  • Phase 3: Recovery Strategies and Continuity Development

  • Phase 4: Implementation and Testing

  • Phase 5: Maintenance 

 

List the steps of the BIA

The below graphic is from Shon Harris AIO 7th Edition page 134, this was the source of my videos, as well as the Sybex.  You can see the list of the BIA as explained by Shon, as well as some of the other phases. 

 

RTO vs RPO vs MTTF vs MTTR

RTO is the maximum amount of time that is needed to bring critical business functions back to normal operating status before that business is crushed.  

 

RPO is the measure of at what point in time a business can go back and still salvage enough data to fully operate.  For example, can a business lose all the data it has accumulated in the last 10 minutes and still operate as a business? Probably.  But can it lose all the data it has accumulated in a 12 hour period and still function? This depends on the type of business.  A company that deals with the stock market and money, probably has a really short RPO, compared to a school with a database of past test scores, which could have a longer RPO.

 

MTTF as we stated is the same thing as MTBF.  It is the measure of how long something is supposed to operate before failure.  

 

MTTR is the amount of time required that is necessary to bring a critical business function back to operation.  The mean time to recovery for your 2nd monitor in a dual monitor setup can probably be 72 hours to a week before you start finding it necessary to have a 2nd monitor again.  The mean time to recovery for your mouse is probably a lot shorter, maybe minutes to hours? 

 

Click here for a video and PDF download on MTD, RPO, RTO, WRT.

 

Due Care vs Due Diligence Example

Differentiating these two is a tough one, it's like comparing when you are angry vs when you are frustrated.  The best way to understand it is to keep reading examples of it until it sinks in.

 

Due Care: Updating, patching, and securing a firewall

Due Diligence: Keep firewall support license warranty up-to-date, review SLA annually, check the news for CVEs against the firewall technology.  

 

Due Care: Doing the immediate right thing, like updating your Windows machine when updates come in
Due Diligence: Maybe look into other types of solutions where there aren't so many vulnerabilities.  For example, if you have a Windows web server, but Windows is experiencing a lot of vulnerabilities that is affecting your business, research the possibility of moving to a Linux machine.

 

Due Care:  Taking the CISSP exam
Due Diligence:  Studying everything you can about the exam before taking it 


Due Care: An action

Due Diligence: A process or framework


You'll also have to know stuff like hot site, cold site, warm site, and the differences between them, along with when each site should be utilized.  

Tags:

Share on Facebook
Share on Twitter
Please reload

STUDY RESOURCES
MEMBERSHIP
  • 200+ CISSP VIDEOS
  • 600+ PRACTICE QUESTIONS
  • PDF NOTES
  • 1,000 FLASHCARDS
  • TELEGRAM GROUP
  • EMAIL UPDATES
  • $29.99 per month
  • $74.99 3-months
  • $144.99 6-months
CRACK THE EXAM

How Chad Cracked His CISSP Exam

November 11, 2019

1/26
Please reload

LEARN ABOUT

© 2013 Study Notes and Theory
Terms and Conditions/Privacy Policy

Proudly created to make you

a better security professional.