Incident response planning can be risky business. It requires you to consider what could happen in the future, so you can best plan for it now. Shorting the predictions can result in severe strategic, reputation, operational, or financial failures, but overestimating the risk exposure can be inefficient and costly, taking resources away from other important business and security matters.
Organizations partner with third parties when the benefit to the organization is perceived to be greater than the risk of outsourcing. With access to third-party expertise, organizations increase their opportunities to offer more services, help more clients, become more efficient, and generate more revenue.
When a potential incident occurs, it can be difficult to know who should be notified. Should the incident be reported to someone in IT, the Information Security Officer (ISO), direct supervisors, or someone else entirely?
Social media is seen as an important part of many modern business plans, including those of banks and credit unions. Social media sites enable virtual communities allowing business owners to deepen business relationships, attract new clients, and monitor what community members say about the business. According to a survey conducted by the American Bankers Association in 2019, 84% of survey participants stated they "agree" or "strongly agree" with the statement "social media is important to my bank."
We recently received a question from one of our Tandem Business Continuity Planning software users.
In its simplest form, business continuity planning (sometimes referred to as business continuity management) is how you prepare for resilience of systems, business processes, and overall operations during adverse circumstances. Business continuity planning is a multi-faceted process, most often including these elements:
NOTE: This article may contain outdated information. See the updated article for details: Updated Ransomware Self-Assessment Tool (R-SAT 2.0).
If your organization operates in an area which could be affected by hurricanes, your Business Continuity Plan (BCP) should include steps to help your organization prepare for the time before, during, and after a hurricane.
In August 2020, the US-CERT Cybersecurity & Infrastructure Security Agency published an alert regarding a malicious actor using COVID-19 as an opportunity for phishing and compromising credentials. The bad actor was sending a phishing email with a link to a spoofed version of the COVID-19 loan relief webpage. As usual, malicious actors are ruthless but clever.
To have an effective Business Continuity Plan (BCP), recovery plans must be based on a Business Impact Analysis (BIA). According to the FFIEC's Business Continuity Management booklet, BIA is "the process of identifying the potential impact of disruptive events to an entity's functions and processes." There are a lot of elements to capital BIA, but for the purpose of this article, we are going to focus on the conceptual lower-case business impact analysis (a.k.a., business impact assessment). This analysis will help you make informed decisions about when certain processes can be restored and help you determine appropriate Recovery Time Objectives (RTO).