Think about that for a moment. Think about how important your computer security system is. Does your cyber security really and truly depend on a business impact analysis?
Maybe you’re a busy person and really don’t have time for malware stuff, right? You’ve got at least fifty million things to do and they are all equally important, right?
Actually, although they might all be quite important, they are not existential. And this is! It really and truly is!
I realize that most companies have enough work to do for more employees than actually exist, but you really must develop a plan for when it happens. And it will. You need a Recovery and Reconstitution Plan.
Business Impact Analysis
A Business Impact Analysis (BIS) cert iv cyber security is key here. It is a vital component of contingency planning and preparation. Your overall output of your Business Impact Analysis will provide your enterprise with two crucial components. They area:
- The characterization and classification of system components, and
- Interdependencies.
Based on your identification of you commercial enterprises mission critical assets (and their associated interdependencies), in the event that your organization is impacted by a potentially destructive condition, recovery and reconstitution efforts should be considered.
In order to plan for this scenario, your enterprise should address the availability and the accessibility for the following resources (and you should also include the scope of these items within your incident response exercises and scenarios.
- A comprehensive inventory of all your mission critical systems and also applications.
- Versioning information,
- System/application dependencies,
- System partitioning/storage configuration and connectivity, and
- Asset owners and the points of contact.
- Contact information for all essential personnel within your organization.
- Secure communication channel for recovery teams.
- Contact information for external organization dependent resources:
- Communication providers,
- Vendors (both hardware and software), and
- Outreach partners/External Stakeholders.
- Application software installation packages.
Other resources you must keep firmly in mind:
-
- Licensing and activation keys for your operating system and its dependent applications.
-
- Enterprise Network topology and Architecture diagrams,
-
- System and application documentation,
-
- Hard copies of operational checklists and playbooks,
-
- System and application configuration backup files,
-
- Data backup Files (both full and differential),
-
- System and application security baseline and hardening checklists/guidelines, and
- System and application integrity test along with acceptance checklists.
YOU MUST HAVE CONTAINMENT BUILT INTO YOUR COMPUTER SYSTEMS!
CYBER SECURITY REQUIRES IT!
I realize you may spend your time hoping against hope that the unthinkable will not happen. Sorry to burst your happy bubble, but the day will come and your commercial enterprise will be penetrated. You might have a large-scale outbreak that seems to be reflective of a destructive malware attack. And in accordance with our Incident Response best practices, your immediate focus should be on containing the outbreak and reducing the scope of additional systems which of course could be further buffeted.