Congratulations on completing the Business Continuity,
Disaster Recovery,
and Incident Response for the Certified in Cybersecurity examination.
Let's do a quick summary of the important things we covered in this domain.
This domain is worth 10% of the examination.
It looked at these three areas and how they relate to each other
and how they ensure that our systems will be available for
business to operate in a secure manner.
The first step in all of this really is incident response.
We deal with incidents as they happen, some maybe major,
some maybe minor,
but sometimes we need to then also invoke a second
process, that of business continuity.
That is when the duration of an incident would exceed acceptable timelines,
and we need to take steps to keep the business going,
hence the name business continuity.
One of the things that we often have to do when there has been a
major disruption is recover things like IT services,
and that is why we also have disaster recovery often
seen to be the recovery of IT, even at an alternate location,
which in many ways is kind of a subset of business continuity.
We have to remember that when something happens,
the first priority is always life safety.
We want to make sure that people are safe,
and therefore, that is the first thing we must address.
We can look at how NIST, the National Institute for Standards and Technology,
defined all of these areas of incidents as,
first of all, being prepared.
We're prepared, we know what to do, then when we detect something,
we already have a plan.
We execute that plan to try to contain the incident and
recover from what actually happened.
And sometimes as we're trying to contain,
we learn more,
we do more detection and analysis until we finally have completed
and eradicated the problem and we can do a review,
what did we learn,
and what we learned as part of post incident activity can
help us be better prepared for next time.
When we looked at business continuity,
we defined a number of key parts of what we're trying to do.
We often don't try to recover everything.
We set a priority on critical business functions first,
and we do this through that process we called business impact analysis,
in other words, analyzing what that impact of an outage would be on the business.
We also had to determine what our drop dead deadlines were,
the maximum tolerable downtime,
and that is the point by which we had to recover or else
maybe we could be out of business altogether,
but that wasn't our goal for recovery.
Our goal for recovery was based on the recovery time objective,
that's when we wanted to recover by,
and we set that so that we could put in place a plan to help us to recover
the critical business functions by that point in time.
We looked at disaster recovery as recovery of operations at
an alternate location which included, of course,
the recovery of the data we needed for the business to run,
the personnel required,
the equipment that we required for our business to operate,
and of course, looking at things such as where that location could be as well.
So here we've looked at these three important points worth 10% of the exam,
and we can move on to our next steps.
Review each of these areas,
make sure we understood them and didn't just memorize them,
for example,
do the sample questions to ensure we really have
understood the concepts behind them, and then proceed to the next domain,
Access Control Concepts.