Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3/25/2020
10:00 AM
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

COVID-19: Getting Ready for the Next Business Continuity Challenge

What comes after you've empowered your remote workforce in the wake of the coronavirus pandemic? Dealing with a large portion of that workforce getting sick at the same time.

Business continuity planning (or resiliency) consists of preparing for how to operate if we lose our technology, facilities, or people. During the COVID-19 pandemic, so far, we are mostly dealing with losing our facility and having to have employees work remotely. What could come next? How do we prepare to deal with a large portion of our workforce getting sick at the same time and requiring isolation?

Generally, the solution for the loss of personnel is cross-training and documentation, but many companies function on tribal knowledge and relationships. This can work fine when everything is normal, but when we start to lose key resources (those human routers that know how to connect to critical institutional knowledge), we need documented processes to reference.

Once you identify the folks who are the only ones who know how to keep a key technology or process running, you need to determine if you can get someone cross-trained and then use that training to document the function. If cross-training will not work, then the individual will have to automate or document everything needed to ensure continuity of operations. I have found this to be one of the hardest challenges but, considering the current pandemic, would say now is the time to pull your critical human and technology resources off of current operations, before you have to develop a crisis management plan instead.

Support phone trees for key functions are vital. It is important to know who the experts are for different key functions. This could include third parties and vendors. While I reference the classic fallback system of phones, today we can also use technology to minimize the impact to an isolated team. To do so, you will need to ensure application access, video teleconferencing capabilities, and collaboration tools with capabilities such as chat or document sharing. However, remember that collaboration tools are only useful if folks know whom to reach out to for support and information.

Map Out Staffing Depth for SLAs
Next, you need to determine your regulatory and contractual service-level agreements (SLAs) and map out the staffing depth you have in order to support them. For areas where you have risk, you need to determine what the criteria is for action. Ask yourself: If we lose 10%, can we still meet our SLAs? What if we lose 50%? What are the impacts, and do we have a plan for acceptable recovery? I will note there are formulas for business impact analysis (BIA) and return to operations (RTO) that can be leveraged here. Depending on the ability of the team to support cross-functional capabilities, you may want to develop a prioritized list of functions you will maintain.

Another option to consider is determining which of your vendors offer service support and making sure you have agreements in place to use them if needed. Having staffing augmentation available is a key lever to be able to pull if needed to keep systems running. 

Along the same lines, if you have not checked in with your suppliers and asked for their business continuity plans, the time to do so is now! You need to understand how mature their capabilities are and be ready to develop options if they fail.

If you don't currently have anyone certified in business continuity, it's a good time to get some of the team trained. Generally, the training is around both business continuity and disaster recovery. A pandemic doesn't really require disaster recovery, which focuses on returning the core technology or facility to operational capacity. If you follow ISO-27000 for security, there is an ISO-22301-certified business continuity manager (CBCM) course that would complement it. If you want more general certifications, there are a number of them run by different training organizations.

The bottom line is that while we are dealing with the challenge of remote workers, now is the time to conduct some exercises on how to fight through the loss of staff. 

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "Three Ways Your BEC Defense Is Failing & How to Do Better."

Steve Winterfeld is the Advisory CISO at Akamai. Steve is focused on being the voice of the customer for Akamai's security vision and helping CISOs solve their most pressing issues. He brings experience with Zero Trust Security Architectures, and integrating multiple tools ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
cnsieler
50%
50%
cnsieler,
User Rank: Apprentice
3/25/2020 | 6:21:19 PM
Teleworking - Not ready for the whole organization at once!
Steve now is the time!      We have been talking about knowlege management for years.   Why are my 2 biggest tools during this time the telephone and email.  We have found out how much remote capacity was needed and we do not have enough for the whole organization to telework at once.  This is a time when one discovers who in your organization has adopted collaborative tools.   I plan to share this with others.

Thank you for the article.

 
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-24847
PUBLISHED: 2020-10-23
A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit his website by social engineering or another attack vector. Due to this issue, an unauthenticat...
CVE-2020-24848
PUBLISHED: 2020-10-23
FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain complete persistent access to the local system.
CVE-2020-5990
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which may lead to local privilege escalation, code execution, denial of service or information disclosure.
CVE-2020-25483
PUBLISHED: 2020-10-23
An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server.
CVE-2020-5977
PUBLISHED: 2020-10-23
NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA Web Helper NodeJS Web Server in which an uncontrolled search path is used to load a node module, which may lead to code execution, denial of service, escalation of privileges, and information disclosure.