Business Requirements Analysis Flashcards
(30 cards)
What is different about health and human safety risks?
It is legal and defensible to accept risks higher than the norm, or greater than your competitors, except risks to health and human safety; these risks must be addressed to the industry standard or the regulatory scheme to which your organization adheres.
BCDR Plans
plans to follow in the event of an outage or disaster
List BCDR architectures in cloud
- On prem, cloud as BCP/DRP - if on prem fails, the failover location is a CSP
- Cloud consumer, primary CSP for BCP/DRP - if part of the cloud provider fails, failover goes to the same CSP at a different location
- Cloud consumer, alternate BCP/DRP - if part of the cloud provider fails, failover goes to a different cloud provider
What is a logical sequence of considerations for BCDR strategy?
- Location - BCDR plans depends on location of the calamity. May require remote location (e.g. flooding, fire, earthquake)
- Failover Architecture - components need to replicate to the same architecture in different location
- Data Replication - maintain a same or less up to date copy of the required data in a different location
- Functionality replication - recreate the same processing capacity in a different location
- Event Anticipation - tooling, functionality and process leading up to the failover response (how and when do you failover)
- Failover Capability - failover capability requires some type of load balancer to redirect user service request to the appropriate service
- Return to Normal - end of the disaster recovery strategy
Asset
Assets can be tangible (HW/SW) or intangible (process, software code, public opinion)
BIA, What is it? How do you do it? Considerations?
Business Impact Analysis - an assessment of the priorities given to each asset and process within an organization
determine a value for every asset (usually in terms of money, but sometimes according to priority/rank, customer perception, or other measures), what it would cost the organization if we lost that asset (either temporarily or permanently), what it would cost to replace or repair that asset, and any alternate methods for dealing with that loss.
Considers the effect or impact any harm or loss of each asset might mean to the organization
Identifies critical paths and single points of failure
Look up and down the chain of dependencies
- Downstream liabilities (if others depend on you, e.g power company)
- Upstream liabilities (if you depend on others, e.g. vendors, suppliers)
How and who should assign valuation/cost in BIA?
Cost can be assigned in various ways including insured value, replacement cost, etc.
Data owners/Line of business manager assign value
BIA vs. BCDR
You do BIA well before BCP and/or DRP
What is the cloud customer always legal liable for?
According to who/what?
according to most of the world’s privacy laws and regulations, the cloud customer is always ultimately legally liable for any loss of data. This is true even if the cloud provider demonstrates negligence or malice.
RPO
Recovery Point Objective - goal for how recent your latest backup/snapshot was or point to rollback to
Amount of data the organization can afford to lose before it impacts business operations
MTD
AKA
Maximum Tolerable Downtime - Maximum amount of time a business can tolerate an outage before the incident causes business failure
MAD - Max Allowable Downtime
RTO
Recovery Time Objective - Time needed to get the critical functions running again (recovery)
WRT
Work Recovery Time - Time needed to configure and to verify the integrity of the recovered system
How does RTO, WRT, and MTD relate?
RTO + WRT <= MTD
Mean Time To Restore/Repair (MTTR)
The average time it takes to restore or repair
Mean Time Between Failures
A measure of how reliable a hardware product is; average time between failures of a HW product
Vertical Analysis
To prioritize the assets and critical systems within a business unit. Collect information in each department, then categorize the assets within each department
Horizontal Analysis
Prioritize the business units (departments) themselves; Steering committee collects the data but senior management makes the final prioritization
BCDR Testing Steps In Order with desc
- Checklist or Desk Check - give each dept a COPY of the PLAN and have them run through the checklist to make sure all relevant points are covered, check phone #, equipment locations, etc.
- Table-Top Review - Representatives get together in a meeting and review the plan collectively without actually performing the actions
- Structured Walk through - Team members physically walk to each location they will need to visit for response activities, then verbally review each step to assess its effectiveness. This will help identify flaws in the plan
- Simulation Test - Practice drill mobilizing the personnel. Done on simulated systems in a sandbox env in attempt to reach RTO
- Parallel test - Operational test at the alternate site running parallel to production
- Full Interruption - Shut down the production environment (home site) and run live environment at the alternate site
What do you need to have prior to running Full-Interruption step of BCDR testing?
- Written management approval
2. At least parallel testing beforehand (make sure alt site is operationally prepared)
Recovery in BCDR
RecOVERing an OPERATIONAL state as soon as possible once a disaster has been declared. Going OVER to the alternate site.
Restoration
Migrating the business back from recovery mode. Going back to the ORGINAL site.
Remember by restORation
What is the order of operations in Recovery vs Restoration
During the disaster, the MOST CRITICAL processes are recovered first
During the return to normal or restoration, the LEAST CRITICAL processes are sent back first
This is where the workbook stops and the book purchased begins
