What is Contingency Planning (CP)?
Overall planning for unexpected events that threaten information assets and security.
Goal: Restore normal operations with minimum cost and disruption after an incident.
Give examples of events covered by contingency planning.
Server/disk failure
Hacker break-in
DoS
Ransomware
Malware
Natural disasters
Extended power failure
Employee error or sabotage.
How does contingency planning relate to Risk Management and ISMS?
It is a key part of the Information Security Management System (ISMS). It is reactive (response & recovery after controls fail) and complements preventive controls from risk management
What are the three main plans that make up Contingency Planning?
Incident Response Planning (IRP)
Disaster Recovery Planning (DRP)
Business Continuity Planning (BCP)
What is the purpose of a Business Impact Analysis (BIA)?
Identify critical processes, assess impact of disruptions, and determine recovery priorities (assuming controls have failed and an attack succeeded)
List the 5 key stages of BIA
1) Threat attack identification
2) Business unit analysis
3) Attack success scenarios
4) Potential damage assessment
5) Subordinate plan classification
Example of threat damage classification
Negligible – no significant cost of damage
Minor - A non-negligible event with no material or financial impact on the business
Major - Impacts one or more departments and may impact outside clients
Crisis - Has a major material or financial impact on the business
Minor, major and crisis events should be documented and tracked to repair
What classification is used to determine the criticality of business processes and services?
Critical $$$ — Cannot be performed manually; very low interruption tolerance
Vital $$ — Manual for very short time only
Sensitive $ — Manual possible for longer, but higher cost
Nonsensitive ¢ — Manual for extended time, low cost
What is done to estimate potential damage assessment?
Estimate cost of best, worst, most likely outcomes by preparing an attack scenario end case
What are RPO and RTO?
RPO (Recovery Point Objective): Maximum acceptable data loss (how far back in time).
RTO (Recovery Time Objective): Maximum acceptable downtime before recovery.
Define these recovery terms: Interruption window, Service Delivery Objective (SDO), Maximum Tolerable Outage
Interruption window: Time the organization can wait before resuming operations.
SDO: Acceptable service level during alternate mode.
Maximum Tolerable Outage: Maximum time allowed in alternate mode.
What is an Incident Response Plan (IRP)? Focus?
Set of procedures triggered when an incident is confirmed.
Focus: Detection and response of an incident. It is a reactive measure.
What is an “incident” in IRP?
A directed attack with realistic chance of success that threatens CIA of information assets.
List the 6 stages of Incident Response
1) Preparation
2) Identification
3) Containment & Escalation
4) Analysis & Eradication
5) Recovery
6) Lessons Learned
Name common incident indicators.
Loss of CIA
Policy/law violations
Reports from users, IDS, antivirus, system administrators
Give examples of incident containment strategies.
Focus on stopping the incident, recovering control of the systems:
Disconnect circuits
Block traffic (firewall rules)
Disable accounts
Shut down compromised services/servers
What are key steps in initiating incident recovery?
Assess damage (preserve evidence)
Fix vulnerabilities
Upgrade/replace controls
Restore from backups
Monitor closely
Rebuild user confidence.
What is Disaster Recovery Planning (DRP)? Focus?
Preparation for and recovery from a disaster (natural or man-made).
Focus: Restore operations at the primary site after disaster.
When is DRP typically activated?
When an incident becomes uncontainable or damage is severe.
How to plan for a disaster?
Scenario development and impact analysis are used to categorise the level of threat of each potential disaster
DRP must be tested regularly
List important elements that should be in a DRP.
Clear roles/responsibilities
Alert roster + notification
Priorities, documentation
Mitigation steps
Alternative implementations
DRP Contents
Pre-incident readiness
Declaration of disaster
Evacuation
Contact lists (IRT, vendors, insurance, recovery sites, law enforcement)
Step-by-step recovery procedures
Resource requirements
What is Business Continuity Planning (BCP)? Focus?
Ensures critical business functions continue during a disaster. Usually owned by the CEO.
Focus: Continue critical operations at alternate site.
How do DRP and BCP work together?
They run concurrently. DRP restores the primary site; BCP maintains critical functions at an alternate site.
-
Threat Modelling with STRIDE/Attack Trees27
-
Security Governance and Information Security Management19
-
Intro to Risk Management40
-
Risk Assessment Methodolgies27
-
Asset Management21
-
Risk Assessment Techniques25
-
Security Policy and Strategic Planning24
-
Security Monitoring and Intelligence0
-
Contingency Planning28
