Risk Management JIT 2 Task 1b
American International Insurance BCP
William Gardner
May 9, 2015

Task B. Create a business contingency plan (BCP) that the company would follow if faced with a major business disruption (e.g., hurricane, tornado, terrorist attack, loss of a data center, the sudden loss of a call center in a foreign country, the collapse of a financial market or other catastrophic event) in which you include the following:
1. Analyze strategic pre-incident changes the company would follow to ensure the well-being of the enterprise.
2. Analyze the ethical use and protection of sensitive data.
3. Analyze the ethical use and protection of customer records.
4. Discuss the communication plan to be used during and following the disruption.
5. Discuss restoring operations after the disruption has occurred (post-incident). Since 1919, A.I.I. has been in the business of insuring businesses and people from losses incurred through disasters. For 95 years (A.I.I.) has stood by its clients as they faced many challenges from the financial collapse of 1929 to the drought of the dust bowl years and even the ravages of World War Two. Assisting our clients in the face of hurricanes, tornados and even terrorist attacks is an everyday occurrence at A.I.I... However, who is planning and preparing for A.I.I.? A BCP is a plan to do exactly that, during the financial collapse of 2008 several flaws in the existing plans were exposed; flaws that not even the terrible events of September 11th 2001 had exposed. These flaws materialized in the necessity of government intervention on behalf of A.I.I. in the face of creditor’s demands and a liquidity crisis brought on by the global financial crisis.

What is a BCP? A BCP is an executive level proactive command and control system which is triggered in the event of a significant event which could adversely affect or disrupt the operation of the firm, eliminate its data management capacity and or data retention systems and falls outside the normal business parameters of expected risks.
What type of events should A.I.I.’s BCP plan address?
Based on the global scale and level of redundancy in systems and operations at A.I.I. a power grid failure or hurricane sized event does not represent a BCP level event thanks to planning and foresight of current and past executives. The effects of another potential global financial crisis can be mitigated to a point via the new financial management systems and procedures put in place after 2010. The greatest threat to A.I.I. is an internet based systems disruption and or attack via cyber terrorism directed at A.I.I. or by proxy at one of our clients or some other unforeseen event involving data security and or retention. 1. What proactive suggestions can be made in advance of an event to mitigate potential damage? a. The formation of an executive level BCP action team to identify key unforeseen risks and department heads to develop and implement a BCP response program for each specific event and each department; it is recommended that the team include contract outside I.T. security vendors and cloud computing firms to facilitate an additional level of data redundancy and security in the event of a data loss, systems shutdown or data breach.
b. The implementation of a quarterly BCP response drill to measure the individual components and member’s response to the “crisis” to identify key areas of concern and remedy response rates and actions as needed.
c. The sourcing of an outside “white-hat hacking firm” to test our systems for the BCP action team with regard to data security and or systems failure. To be conducted without business interruption.
d. The creation of a BCP calls list and hierarchy which in a BCP event takes immediate effect; For example the US Army and DIA utilize the following hierarchy and calls list to notify key personnel in the event of a BCP event.

To be successful a BCP requires; * Full executive and upper management commitment to the BCP process * The resources and funding required completing the BCP and implementing both the planning and practice phases. * Timely and open review and feedback of both the planning and practice phases

Feedback should include; * Both internal and external intelligence and security sources * Financial Analysis of potential impact * Evaluation of vendor performance * Evaluation of BCP action team and division managers performance * Evaluation of technical team performance

To assist the development of the BCP Action team and to provide a foundational reference for an action plan I have included the U.S. Army’s IT contingency planning (ITCP) as published in Army Pamphlet 25-1-2;
(ITCP) should;
(1) Be addressed throughout the system development life cycle
(2) Establish a sole ITCP coordinator with the responsibility for planning and ITCP.
(3) Identify and prioritize MEFs. (Mission essential functions)
(4) Establish baseline category requirements.
(5) Address risk management and mitigation.
(6) Establish system backup procedures.
(7) Create a Federally compliant ITCP. (Not required at A.I.I. but the highest standard available)
(8) Address plan testing, training and reporting
(9) Address how ITCP requirements will be incorporated into daily operations.
(10) Address how the ITCP relates to other disaster and emergency plans.
(11) Evaluate the system to link these critical services to system resources. The evaluation of the system and the critical system resources is then divided into the following five step system from initiation and development to disposal.

Having spent a good portion of my adult life in Army Special Operations I can attest to two things, the first being data security is a life and death issue in the Army and secondly no one places more of a priority on planning for unforeseen events then the Army does. In my opinion A.I.I. can benefit from emulating the high professional standards and the level of accountability the U.S. Army requires in terms of ITCP. Each phase of the ARMY ITCP has accompanying actions and measurable deliverable requirements including budgetary penalties for non-compliant managers and or commanders. In our opinion duplicating the Army’s policy of adding a monetary penalty in budgetary terms for individual unit managers would greatly increase compliance and cooperation as it illustrates the importance of the ITCP program. B2. Analyze he ethical use and protection of sensitive data. As an insurance and financial services firm the customer data and proprietary information which A.I.I. is in procession of is our most critical resource. Any breach of trust or ethical violations which occurs as a result of our use or disclosure of confidential and or proprietary data could be devastating to A.I.I. For this reason we recommend the following steps be taken to mitigate the potential unethical use of confidential data.
How do we protect our client’s data?
1. Active Systems administrator monitoring, A.I.I. should monitor the access to all confidential data by employing a third party vendor who is capable of monitoring the systems administrators accounts and access privileges for unusual and or anomalous activity.
2. Consistently seek out and utilize the best internet security systems. To include the most advanced firewalls and encryption systems to prevent and or limit the potential of illegal external access and the best available personnel to maintain and manage the systems.
3. Employee training and monitoring- By requiring ethics training for all employees who have access to our systems on the use of confidential data and then monitoring compliance with our ethical standards we can add a level of accountability to the data security system which is not currently in place. A.I.I. requires confidential data from our customers in every single one of our transactions, and for 95 years we have built a legacy of trust with our clients that their data is secure with us, by implementing a data ethics training and compliance system we can ensure that our clients can and will trust us for another 95 years. While clients may accept confidential data being stolen by a third party they are not likely to accept one of our employees’ misusing or stealing their confidential information. Actively monitoring the system users adds an additional layer of protection just in case an ethical violation was to occur.
How do we insure data recovery and system backup in a BCP event? Simply put we can’t, data recovery and system backup must become part of the daily routine, adding additional layers of redundancy via cloud based data storage to supplement our existing cross location internal storage and server farms is a data security requirement because in the event of a BCP event it will be too late for backing up at that point. In the BCP event backing up systems could also compromise the systems and data further by facilitating additional security breaches and allow a malicious code to enter the backup system. Each manager tasked must be held to a standard of daily backup, across platforms to ensure data security and continued access upon recovery from the BCP event. There are three levels of system back-up
1. Full- Full backup copies the entire system to another server and or the cloud based system.
2. Incremental- Incremental backup copies only the new files since the last backup to another server and or cloud based storage.
3. Differential- Differential backup copies all files which have changes since the last backup.

Each of these three types of system or file backups require a different amount of time and bandwidth to complete, therefore each type of backup will require a different budgetary allowance from the individual unit manager. Creating an (SOP) or standard operating procedure which is based on the needs and requirements of each specific business unit is recommended. The requirements should be predicated on the sensitivity and reparability of the data. Minimum standards for data backup should be constituted and no budgetary penalty should be incurred by managers who take a more conservative approach to data preservation and recovery. Beyond the timing and methodology of backup file creation, data recovery is dependent on several technical issues related to mirroring, striping, and parity which are beyond the scope of this presentation but should be addressed by the BCP Action Team. These technical issues relate to the quality and error rates of the data once recovery operations are instituted following a BCP event.

In the event of a BCP event the data recovery solutions instituted by the BCP action team will be triggered, and data recovery should occur in seconds predicated on the available bandwidth, RAID level, and redundancy levels selected by the team. Higher redundancy provides for greater data recovery but may take several more seconds per Megabyte. Depending upon the data loss and or system failure rate restoring data to pre-event levels may take seconds, minutes or hours. Provided that unit managers and the I.T. staff are compliant and the SOP for data backup is sufficiently stringent, A.I.I.’s capacity to facilitate a timely recovery will not be an issue once the source and extent of any system damage is assessed and addressed.

Key Points for Data Recovery and Backup
1. Redundancy
2. Backup SOP
3. Manager Compliance with Backup SOP
4. Bandwidth and RAID level
5. I.T. Staff Compliance and training
6. Budget for offsite mirror servers and cloud based storage solutions.

B4. Communications Plan
Today down-time is clearly not an option and smart communications are an essential aspect of achieving workable IA solutions. Smart communications work to resolve a range of issues, including: [ (Hiles, 2007) ] * Reducing RTO * Reducing RPO * Reducing costs * Providing resilience * Business protection * Demonstrable risk management and compliance * Providing additional resources and/or skills.

In the event which triggers the necessity of the BCP to be implemented the first barrier to implementing the plan will be facilitating communication to the BCP Action Team Members and from the members to other key personnel and vendors. Creating an emergency communications plan will facilitate A.I.I.’s rapid recovery in the event of a BCP Event. An Emergency Communication Plan must be able to; 1. Be activated quickly. 2. Provide information to senior management on the situation. 3. Prepare and issue press releases if authorized regarding data breach. (not recommended) 4. Organize and contain amount and content of broadcast media coverage.(Spin, damage control to prevent adverse market reaction if required) 5. Constantly provide secure data to BCP Action Team regarding scope and scale of ongoing breach and follow established procedural instructions to inform employees and other stakeholders with regard to the network potentially being compromised. 6. Continually adapt to resource limitations. Based on the likely manner of a BCP triggering event, (cyber) establishing a communications chain is highly recommended and as these communications will likely need to occur via cellular or analog telephone systems, once a data breach is detected the vendor and or system administrator who discovers the breach should initiate the call chart. Example Below As the type of event is directly correlated to secure customer data, maintaining strict operational control and security over the information communicated is critical. The call chart is designed to facilitate communication to BCP Action Team Leader who is directly tasked with communications with Senior Management. Senior Management will then determine the scope of public communications required based on the events size and scope. Most large firms, particularly publicly traded ones are not likely to disclose more information than is required based on the event to control market reaction and limit volatility in share prices. The creation of the Network Enterprise Center, NEC (in the implementation phase of this paper) is intended to facilitate the implementation of not only an emergency communications plan, but a recovery plan. Having the NEC and its BCP action team members design an A.I.I. specific incident communications strategy along with the legal and public relations departments will ensure that the BCP Action Teams communications are clear and concise during an event. Clear communication being the operative word, the cascading call list prevents multiple versions of events from dissemination in both directions. As a global firm with 24 hour operations A.I.I.’s NEC should be manned 24 hours a day with members of the BCP Action Team, additionally the new internal security vendor will have a staff member on site per their contract. The 24 hour availability will increase reaction times and ensure that the emergency communications plan is implemented and information regarding any event is not inadvertently released to the public. Along with the data loss or intention breaching of the systems the Emergency Communication Plan should include an operating procedure to address the potential of CYBER kidnapping and or blackmail particularly a public communications piece.

B5. Restoring Operations
The most common recovery strategy is data backup. So why do we back up our data: [ (Hiles, 2007) ] * To restore our data in the event of a disaster * To retrieve a file in case of deletion or corruption * To store historical data to ensure compliance with industry regulators. * How do we insure data recovery and system backup in a BCP event?
(All of this was previously on this paper but no heading was on it) Simply put we can’t wait for the event to occur, data recovery and system backup must become part of the daily routine, adding additional layers of redundancy via cloud based data storage to supplement our existing cross location internal storage and server farms is a data security requirement because in the event of a BCP event it will be too late for backing up at that point. In the BCP event backing up systems could also compromise the systems and data further by facilitating additional security breaches and allow a malicious code to enter the backup system. Each manager tasked must be held to a standard of daily backup, across platforms to ensure data security and continued access upon recovery from the BCP event. * There are three levels of system back-up * 1. Full- Full backup copies the entire system to another server and or the cloud based system. * 2. Incremental- Incremental backup copies only the new files since the last backup to another server and or cloud based storage. * 3. Differential- Differential backup copies all files which have changes since the last backup. Each of these three types of system or file backups require a different amount of time and bandwidth to complete, therefore each type of backup will require a different budgetary allowance from the individual unit manager. Creating an (SOP) or standard operating procedure which is based on the needs and requirements of each specific business unit is recommended. The requirements should be predicated on the sensitivity and reparability of the data. Minimum standards for data backup should be constituted and no budgetary penalty should be incurred by managers who take a more conservative approach to data preservation and recovery. Beyond the timing and methodology of backup file creation, data recovery is dependent on several technical issues related to mirroring, striping, and parity which are beyond the scope of this presentation but should be addressed by the BCP Action Team. These technical issues relate to the quality and error rates of the data once recovery operations are instituted following a BCP event.

* In the event of a BCP event the data recovery solutions instituted by the BCP action team will be triggered, and data recovery should occur in seconds predicated on the available bandwidth, RAID level, and redundancy levels selected by the team. Higher redundancy provides for greater data recovery but may take several more seconds per Megabyte. Depending upon the data loss and or system failure rate restoring data to pre-event levels may take seconds, minutes or hours. * Provided that unit managers and the I.T. staff are compliant and the SOP for data backup is sufficiently stringent, A.I.I.’s capacity to facilitate a timely recovery will not be an issue once the source and extent of any system damage is assessed and addressed.
Key Points for Data Recovery and Backup * 1. Redundancy * 2. Backup SOP * 3. Manager Compliance with Backup SOP * 4. Bandwidth and RAID level * 5. I.T. Staff Compliance and training * 6. Budget for offsite mirror servers and cloud based storage solutions.
Conclusion
As a financial services firm which operates globally and 24hours a day, A.I.I. must have a business contingency plan. In this paper we have identified the only event which could interrupt the entire global entity a cyber event, and presented a plan to address the event via the creation of a BCP action team. We have also addressed the ethical issues which we face due to the customer data which we have on file and require as part of our day to day operations and how best to implement a plan to further secure that data and minimize the potential for ethical violations of our data policy via a training, compliance and monitoring system.

Works Cited
Behnia, A., Abd-Rashid, R., & Chaudrhy, J. (2012). Smart Computing Review. A Survey of Information Security Risk Analysis Methods , 1-16.

Hiles. (2007). Strategies for IT and Communications. In The Definitive Handbook of Business Continuity Management, Second Edition. NY: John Wiley & Sons .

Rot, A. (2008). IT Risk Assessment: Quantitative and Qualitative Approach . World Congress on Engineering and Computer Science .