• United States




Business continuity starts with us

Sep 18, 20082 mins
Business Continuity

Since this is my first posting, I’m going to set the tone for my future comments and opinions about business continuity, how it fits into an overall security program. I might be a little unusual, but I get pretty excited when talking and writing about data and system availability assurance. So let’s jump right in.

Most security professionals are familiar with the CIA triad of security—confidentiality, integrity, and availability. Confidentiality and integrity seem to get most, if not all, the attention. Because loss of availability doesn’t usually cause the same journalistic frenzy, it is often pushed to the bottom of the IT priorities list. But business continuity isn’t just an IT issue.

During my years of dealing with disaster recovery and business continuity issues, I concluded that IT is typically much better at paying attention to at least catastrophic event planning than the business users. Management teams outside the IS department see DR and business continuity management (BCM) as an “IS problem.” Little attention is paid to DR outside of ensuring there is a hot site contract in place, to be dusted off during the annual audit.

In my opinion, security managers must assume leadership of BCM. Like other security controls, it’s up to the CSO to make a business case for planning for service interruption events. Working with risk management personnel, if they exist outside the security function, security managers are in a good position to demonstrate business impact if employees are unable to execute against existing business processes. After all, understanding business processes is a key element of segregation of duties and least privilege enforcement as well as HIPAA and SOX compliance. BCM is more than restoring data center function after a disaster. It is a proactive approach to ensuring established processes are designed and implemented to consistently achieve business objectives, even when the unexpected happens.

Future posts will address these and other issues related to BCM, including:

  • The importance of a BCM strategy and how to create one

  • How a management supported BCM policy starts the process of strengthening availability as well as integrity and confidentiality

  • The differences and similarities between BCM and disaster recovery

  • How the guidelines included in the

Tom Olzak is an information security researcher and an IT professional with more than 34 years of experience in programming, network engineering and security. He has an MBA and a CISSP certification. He is an online instructor for the University of Phoenix, facilitating 400-level security classes.

Tom has held positions as an IS director, director of infrastructure engineering, director of information security and programming manager at a variety of manufacturing, healthcare and distribution companies. Before entering the private sector, he served 10 years in the U.S. Army Military Police, with four years as a military police investigator.

Tom has written three books: Just Enough Security, Microsoft Virtualization, and Enterprise Security: A Practitioner's Guide. He is also the author of various papers on security management and has been a blogger for, TechRepublic, and Tom Olzak on Security.

The opinions expressed in this blog are those of Tom Olzak and do not necessarily represent those of IDG Communications Inc. or its parent, subsidiary or affiliated companies.