BC-DR in the Cloud

---

Cloud Specific BIA Concerns

• when migrating to cloud architecture, review existing business impact analysis (BIA)
  • conduct a new or partial business impact analysis for cloud concerns
• BIA concerns:
  • New dependencies
    • data and operations are reliant on external parties
    • including provider’s vendors, suppliers, utilities, personnel, etc.
    • take into account provider’s inability to meet service requirements
  • Regulatory failure
    • data distribution in cloud enhances potential violation of regulations
    • cloud provider presents a potential point of failure for compliance
      • even if your organization is fully compliant
  • Data breach/inadvertent disclosure
    • cloud magnifies the risk likelihood and impact of:
      • internal personnel
      • remote access
    • full legal liability of breaches cannot be transferred to provider
      • so need to reassess impact of disclosure
    • address in BIA:
      • public disclosure of internal communication and reporting
      • loss of competitive advantage
      • negative effect on customer, supplier, and vendor goodwill
      • contractual violations
  • Vendor lock-in/lock-out
    • take risks into account for any operations migrated to the cloud

Customer/Provider Shared BC/DR Responsibilities

• BC/DR responsibilities need to be negotiated between provider and customer
  • including:
    • how and where it will be done
    • who is responsible for each part of the process
    • etc.

Logical Location of Backup Data/Systems

• 3 general means of using cloud backups for BC/DR:
  • Private Architecture, Cloud Service as Backup
    • organization maintains own traditional IT data center
      • primary production environment
    • BC/DR plans can use could use cloud provider as a backup
    • things to negotiate with cloud provider:
      • periodic upload bandwidth costs
        • monthly caps are typically limiting factor
      • frequency of backups
      • full, incremental, or differential backup schedule
      • security of data and systems at backup data center
      • ISP costs
    • determine when failover will occur
      • what constitutes an emergency for backup switch
      • can be using the cloud provider as the backup or downloading the data from cloud to another physical production site
    • how long failover will take
    • how and when data will be restored to normal operation
  • Cloud Operations, Cloud Provider as Backup
    • Cloud providers may offer a backup solution as a feature of their service
      • typically offered at no or little cost
    • backups should be stored at different geographical regions
    • provider will have
      • all responsibility for determining location and configuration of backup
      • most responsibility for declaring disaster events
  • Cloud Operations, Third-Party Cloud Backup Provider
    • Production operations are hosted by one cloud provider
      • contingency operations require failover to another cloud provider
    • customer may opt for this to:
      • distribute risk
      • enhance redundancy
      • preemptively attenuate the possibility of vendor lock-in/lock-out
    • most complicated cloud BC/DR arrangement to negotiate
      • cloud provider and customer participate in emergency/disaster assessment and declaration
      • failover may require joint effort
        • can be difficult to navigate during emergency
    • typically more expensive
    • data format/system interoperability is a concern too

Declaration

• Declaring a disaster event is a crucial step in BC/DR
• cloud customer and provider must decide who specifically will be authorized to make this decision
  • prior to contingency
  • have an explicit process for communication
  • customer organization should have designated office or person
    • have a deputy or backup person
    • both receive detailed emergency operations training
    • authorized to:
      • declare disaster
      • initiate failover
• have a warning system in place to assess impending disasters
• prepare to failover prior to actual crisis event
  • to maintain continuity of operations
• customer and provider must agree on what constitutes formal notice
  • setup a preliminary schedule of preparatory communication before formal declaration
• If cloud provider has to conduct some failover activity,
  • contract should stipulate time within this needs to be done after notice is received
  • if failover is automated and full controlled by customer, then needs to be detailed in contract
• resumption of normal operations requires formal notification
  • operations should be tasked to specific entity in customer organization
  • process should be enumerated in contract

Testing

• Perform failover testing to demonstrate efficacy of the plan and procedures
  • also the return to normal operations
• testing provides training to personnel
• testing constitutes an interruption to normal service
  • contains risk
• industry guidance stipulates to conduct testing annually
  • frequency may increase depending on nature of organization and its operations
• coordinate testing with cloud provider
  • determine and assign specific responsibilities
  • detail all liabilities for problems occurring during testing in contract