# Week 10 ## Slide 1 - Disaster Recovery and Business Continuity  ## Slide 2 - Agenda  Agenda a) Data backup, storage, maintenance, retention and restoration processes, and practices b) Regulatory, legal, contractual, and insurance issues related to business continuity and disaster recovery c) Incident response d) Change management ## Slide 3 - Disaster Recovery and Business Continuity -  Disaster Recovery and Business Continuity - Overview: • Disaster Recovery (DR) and Business Continuity (BC) are critical components of an organization's risk management strategy. DR focuses on the IT and technical aspects of recovering from a disaster, while BC encompasses the broader plan to ensure the continuity of business operations during and after a disaster. ## Slide 4 - A. Data Backup, Storage, Maintenance  - A. Data Backup, Storage, Maintenance, Retention, and Restoration Processes and Practices 1. Data Backup: • Definition: The process of copying and archiving data to ensure its availability in the event of data loss or corruption. • Types: Full, incremental, and differential backups. • Example: A company might perform a full backup weekly and incremental backups daily to minimize data loss. 2. Storage: • Definition: The method of storing backup data, which can include on - premises storage, cloud storage, or hybrid solutions. • Example: A business might use cloud storage for its scalability and accessibility, allowing for quick restoration of data from any location. 3. Maintenance: • Definition: Regular upkeep of the backup system, including testing and updating backup software and hardware. • Example: Monthly testing of backup systems to ensure they are functioning correctly and can restore data as expected. 4. Retention: • Definition: The policy dictating how long backup data should be kept before being deleted or archived. • Example: A healthcare organization may retain backup data for seven years in compliance with regulatory requirements. 5. Restoration: • Definition: The process of recovering data from backups in the event of data loss or corruption. • Example: Restoring a database from the most recent backup after a corruption incident. ## Slide 5 - Choose a Backup Method  Choose a Backup Method ⚫ Full backup − This is the best possible method of data backup because all system data is copied to a backup media (usually once a day) − To restore data ⚫ The most current backup media is used to restore data − Disadvantage ⚫ Takes a lot of time to perform full backups − The full backup should be performed when the system is not used ## Slide 6 - Choose a Backup Method Cont  Choose a Backup Method cont. ⚫ Perform an incremental backup − Perform a full back up once a week − Then you perform an incremental backup every day ⚫ The incremental backup only copies files that have changed since the backup the day before (full or incremental) − To restore data: ⚫ First restore from the full back up and then from all the taken incremental backups (in order they were taken) − Advantage ⚫ Backup window can be much smaller as incremental backup only copies data that has changed since the backup the day before − Disadvantage ⚫ Recovery time is longer  ## Slide 7 - Choose a Backup Method Cont  Choose a Backup Method cont. ⚫ Perform a differential backup − Perform a full back up once a week − Then you perform differential backups every day ⚫ The differential backup only copies files that have changed since the last full backup − To restore data: ⚫ First restore from the full back up and then from the last taken differential backup − Advantage ⚫ Backup window can be much smaller as differential backup only copies data that has changed since the last full backup − Disadvantage ⚫ Amount of data to be backed up grows every day ⚫ Recovery time is longer ## Slide 4 - A. Data Backup, Storage, Maintenance  A. Data Backup, Storage, Maintenance, Retention, and Restoration Processes and Practices 1. Data Backup: • Definition: The process of copying and archiving data to ensure its availability in the event of data loss or corruption. • Types: Full, incremental, and differential backups. • Example: A company might perform a full backup weekly and incremental backups daily to minimize data loss. 2. Storage: • Definition: The method of storing backup data, which can include on - premises storage, cloud storage, or hybrid solutions. • Example: A business might use cloud storage for its scalability and accessibility, allowing for quick restoration of data from any location. 3. Maintenance: • Definition: Regular upkeep of the backup system, including testing and updating backup software and hardware. • Example: Monthly testing of backup systems to ensure they are functioning correctly and can restore data as expected. 4. Retention: • Definition: The policy dictating how long backup data should be kept before being deleted or archived. • Example: A healthcare organization may retain backup data for seven years in compliance with regulatory requirements. 5. Restoration: • Definition: The process of recovering data from backups in the event of data loss or corruption. • Example: Restoring a database from the most recent backup after a corruption incident. ## Slide 8 - to Business Continuity and Disaster Recovery  B. Regulatory, Legal, Contractual, and Insurance Issues Related to Business Continuity and Disaster Recovery 1. Regulatory Issues: • Example: In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) requires businesses to protect personal information, which includes having a robust DR and BC plan. 2. Legal Issues: • Example: Failure to comply with industry - specific regulations (such as HIPAA in healthcare) can result in legal penalties and lawsuits. 3. Contractual Issues: • Example: Service Level Agreements (SLAs) with clients may require specific DR and BC provisions, such as guaranteed uptime and data recovery times. 4. Insurance Issues: Example: Businesses may need to have specific insurance policies covering losses due to disasters. The coverage and premiums may depend on the company's DR and BC preparedness. ## Slide 9 - Case Study: Disaster Recovery and Business  Case Study: Disaster Recovery and Business Continuity in a Canadian Company • Background: • A Canadian e-commerce company, " MapleShop," experienced a significant data breach and server failure due to a cyber - attack. The attack resulted in the loss of critical customer data and disrupted business operations. • Challenges: • Compliance with PIPEDA regulations. • Ensuring minimal downtime to maintain customer trust and avoid revenue loss. • Restoring lost data and securing the system against future attacks. ## Slide 10 - Solution  Solution • Data Backup and Restoration: Maple Shop had implemented a robust backup strategy with daily incremental backups and weekly full backups stored in a secure cloud environment. This allowed for quick restoration of data once the security breach was contained. • Business Continuity Plan: The company had a BC plan that included alternative processing sites and emergency communication protocols. This ensured that key business functions could continue while the primary systems were being restored. • Regulatory Compliance: The company worked closely with legal advisors to ensure all actions taken were in compliance with PIPEDA and other relevant regulations. • Insurance: Maple Shop had cyber insurance that covered some of the financial losses and expenses incurred due to the cyber - attack. ## Slide 11 - Outcome  Outcome • Maple Shop was able to resume operations within 48 hours of the attack, with minimal data loss thanks to their DR and BC plans. The incident also prompted a review and strengthening of their security measures to prevent future attacks. ## Slide 12 - Require Robust Disaster Recovery and Business  The topics of Disaster Recovery and Business Continuity, particularly in the context of data backup, storage, maintenance, retention, and restoration processes, are closely related to auditing in several ways: • Compliance Audits: Organizations often need to comply with industry - specific regulations and standards that require robust disaster recovery and business continuity plans. Auditors assess whether these plans are in place, properly documented, and in compliance with relevant regulations. • Risk Assessment: Auditors evaluate the effectiveness of an organization's disaster recovery and business continuity plans as part of the overall risk assessment. They identify potential risks to data integrity, availability, and confidentiality and assess the adequacy of the measures in place to mitigate these risks. • Testing and Validation: Auditors examine whether the organization regularly tests and validates its disaster recovery and business continuity plans. This includes reviewing the results of testing exercises and ensuring that any identified weaknesses are addressed. • Data Integrity and Availability: Auditors assess the processes and practices related to data backup, storage, maintenance, retention, and restoration to ensure that data is protected against loss, corruption, and unauthorized access. This includes evaluating backup schedules, data encryption, and access controls. • Documentation and Record - Keeping: Auditors review the documentation related to disaster recovery and business continuity plans to ensure it is up - to - date, comprehensive, and accessible. This includes reviewing records of backup and restoration activities, test results, and any changes to the plans. • Incident Response: Auditors assess the organization's incident response capabilities, which are closely tied to disaster recovery and business continuity. This includes evaluating how the organization responds to and recovers from incidents that could impact business operations or data integrity. ## Slide 13 - Continuity Plans Are Effective, Compliant With  - Overall, auditing plays a crucial role in ensuring that an organization's disaster recovery and business continuity plans are effective, compliant with regulations, and capable of protecting the organization's data and operations in the event of a disaster. ## Slide 14 - Incident Response  Incident Response • Definition: Incident response refers to the process an organization follows to handle a data breach or cyberattack. The goal is to effectively manage the incident to minimize damage, reduce recovery time and costs, and mitigate the breach's impact. ## Slide 15 - Key Components  Key Components • Preparation: Developing an incident response plan that includes roles and responsibilities, communication strategies, and tools and resources needed during an incident. • Identification: Detecting and determining the nature and scope of the incident. Monitoring tools and alert systems play a crucial role here. • Containment: Implementing short - term containment measures to limit the spread of the incident, followed by long - term containment to secure the environment. • Eradication: Removing the cause of the incident, such as malware, and securing vulnerabilities. • Recovery: Restoring and validating system functionality for business operations, ensuring no threats remain. • Lessons Learned: Reviewing and analyzing the incident and the response to improve future readiness. • Example: A financial institution experiences a phishing attack leading to unauthorized access to customer data. The incident response team is activated, containing the breach and working to identify the extent of the compromise. After removing the attacker's access, they restore the affected systems from backups and strengthen their email filters and employee training to prevent future incidents. ## Slide 16 - Change Management  Change Management • Definition: Change Management in IT and auditing refers to a systematic approach to managing all changes made to a system or IT environment, ensuring that changes do not negatively affect system integrity, security, and availability. ## Slide 17 - Key Components  Key Components • Request for Change: Initiating changes requires a formal process, including a detailed description, rationale, impact analysis, and approval. • Impact Assessment: Evaluating the potential impact of the change on business operations, security, and compliance requirements. • Change Approval: Changes must be approved by relevant stakeholders, including IT management, security, and compliance officers. • Implementation: Implementing the change according to a predefined plan, ensuring minimal disruption to services. • Review and Closure: After implementation, the change is reviewed to ensure it has achieved its objectives without introducing new issues. • Example: A company plans to upgrade its customer relationship management (CRM) system. The change management process ensures the upgrade is planned, tested, and implemented without disrupting sales operations or compromising customer data security. ## Slide 18 - Case Study: Implementing a New Security Software  Case Study: Implementing a New Security Software • Background: An organization decides to implement new security software to enhance its cybersecurity posture. • Challenge: The new software requires significant changes to the organization's IT infrastructure and has the potential to affect both system performance and security. ## Slide 19 - Solution  Solution • Incident Response: The organization reviews its incident response plan to ensure it's prepared to handle any incidents that may arise during or after the software implementation. • Change Management: A comprehensive change management plan is developed, including thorough testing of the new software in a staging environment, assessing the impact on existing systems, and training employees on any new security protocols. • Outcome: The software implementation proceeds smoothly, with no significant incidents. Post - implementation reviews confirm that the new software has strengthened the organization's security measures without adversely affecting system performance. --- Made With Glean | [Open Event](https://app.glean.co/event/48753ee1-b6b9-4283-a224-af748aac1dec)