DOCSLIB.ORG

20 Verzeichnis Der Abbildungen

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

20 Verzeichnis der Abbildungen Abbildung 2-1: Dreidimensionale IT- bzw. IKT- bzw. IKT-Sicherheits- (management)pyramideDr.-Ing. Müller V bzw. ISM- PyramideDr.-Ing. Müller ............................................................................ 30 Abbildung 5-1: ISO-27000-Familie (Teil 1/2) .......................................................... 107 Abbildung 5-2: ISO-27000-Familie (Teil 2/2) .......................................................... 107 Abbildung 5-3: ITIL Service Life Cycle ................................................................. 152 Abbildung 5-4: Software Assurance Maturity Model ........................................... 168 Abbildung 5-5: Struktur einer SOAP-Nachricht (Beispiel) ................................... 174 Abbildung 6-1: Schutzobjektklassen ........................................................................ 210 Abbildung 6-2: Detaillierter SicherheitsdreiklangDr.-Ing. Müller ................................. 212 Abbildung 6-3: Detaillierter RisikodreiklangDr.-Ing. Müller ......................................... 215 Abbildung 7-1: SicherheitspyramideDr.-Ing. Müller, Version V, bzw. Sicherheitsmanagementpyramide Dr.-Ing. Müller, Version V ............ 222 Abbildung 10-1: House of Safety, Security and Continuity (HoSSC) ................... 269 Abbildung 10-2: Safety, Security and Continuity Function Deployment (SSCFD) ............................................................................................ 270 Abbildung 11-1: Risikolandkarte und Risikoklassen (Beispiel) ............................. 289 Abbildung 11-2: Management-, Kern-, Support- und Begleitprozesse im Lebenszyklus ................................................................................... 330 Abbildung 11-3: Begleitprozesse (Managementdisziplinen) ................................. 337 Abbildung 11-4: Risiko(management)pyramideDr.-Ing. Müller Version V ................... 351 Abbildung 11-5: Risikoermittlung auf Basis des RisikodreiklangsDr.-Ing. Müller ....... 354 Abbildung 11-6: Business Continuity Management mit der Sicherheits- pyramide V ...................................................................................... 397 Abbildung 11-7: KontinuitätspyramideDr.-Ing. Müller, Version V bzw. KontinuitätsmanagementpyramideDr.-Ing. Müller, Version V .......... 398 Abbildung 11-8: Business Continuity PyramidDr.-Ing. Müller, Version V or BCM pyramidDr.-Ing. Müller, Version V ........................................................ 400 Abbildung 11-9: Datensicherungsmethoden ............................................................ 420 Abbildung 11-10: Über-Kreuz-Sicherung ................................................................... 425 © Springer Fachmedien Wiesbaden GmbH, ein Teil von Springer Nature 2018 K.-R. Müller, IT-Sicherheit mit System, https://doi.org/10.1007/978-3-658-22065-5 20 Verzeichnis der Abbildungen 733 Abbildung 11-11: Allgemeines SicherheitsschalenmodellDr.-Ing. Müller ........................ 429 Abbildung 11-12: Elemente des Securitymanagements gemäß SicherheitsschalenmodellDr.-Ing. Müller ............................................... 434 Abbildung 11-13: Berechtigungswürfel bzw. -kubus ................................................ 436 Abbildung 11-14: Subjekt-Subjektgruppe-Recht-Objektgruppe-Objekt-Modell .... 437 Abbildung 11-15: Taschenauthentifikator (Prinzipdarstellung)............................... 443 Abbildung 11-16: Verschlüsselungsverfahren ............................................................ 455 Abbildung 11-17: Schadenskategorien ......................................................................... 473 Abbildung 11-18: Bezugsgruppen (Stakeholder)........................................................ 474 Abbildung 11-19: Generische Akteure/Akteursgruppen im Lebenszyklus (Auszug) ........................................................................................... 475 Abbildung 11-20: Speichermedien ................................................................................ 506 Abbildung 11-21: DAS, NAS, SAN ............................................................................... 511 Abbildung 11-22: Firewallebenen (Prinzipdarstellung) ............................................ 518 Abbildung 11-23: Webanwendungen (Prinzip der Sicherheitszonen) .................... 521 Abbildung 11-24: Interdependenznetz (prinzipielles und vereinfachtes Beispiel) .................................................................... 552 Abbildung 12-1: Notfallablauf .................................................................................... 609 Abbildung 12-2: EskalationstrichterDr.-Ing. Müller ........................................................... 611 Abbildung 16-1: Sicherheits-/RiSiKo-Studie/-Analyse ............................................. 687 Abbildung 16-2: Sicherheitsregelkreis ....................................................................... 695 Abbildung 17-1: ReifegradmodellDr.-Ing. Müller, hier für Sicherheit und RiSiKo ........ 714 Abbildung 18-1: Sicherheits-/RiSiKo-(Management-)prozessDr.-Ing. Müller ................ 723 21 Verzeichnis der Tabellen Tabelle 3-1: Zehn Schritte zum Sicherheitsmanagement ...................................... 38 Tabelle 9-1: Primäre und sekundäre Sicherheits- und Kontinuitätskriterien ... 257 Tabelle 11-1: Sicherheitszonen-Maßnahmen-Matrix (SZMM) ............................. 311 Tabelle 11-2: Prinzipien versus Sicherheitskriterien .............................................. 326 Tabelle 11-3: Datenschutzkontrollen ....................................................................... 348 Tabelle 11-4: Prozentuale Verfügbarkeit und maximale Ausfalldauer ............... 402 Tabelle 11-5: Vor- und Nachteile von Datensicherungsmethoden ...................... 421 Tabelle 11-6: Verschlüsselungsverfahren und Standards ..................................... 456 Tabelle 11-7: Sicherheits-Hash-Algorithmen .......................................................... 458 Tabelle 11-8: Sicherheitskriterien und Schutzmaßnahmen................................... 462 Tabelle 11-9: Präventive Datenträgererneuerung [65]........................................... 507 Tabelle 11-10: Schutzmaßnahmen und Sicherheitsklassen (Gebäude, Räume, Versorgung) (Beispiel) ........................................................................ 548 Tabelle 11-11: RiSiKo-Architekturmatrix .................................................................. 554 Tabelle 12-1: Definitionen für Störung, Notfall, Krise, Katastrophe im Über- blick ....................................................................................................... 595 Tabelle 12-2: Schadensszenarien .............................................................................. 617 Tabelle 15-1: Kompakte Phasen-Ergebnistypen-Tabelle ....................................... 683 Tabelle 18-1: RiSiKo-Managementprozess (Input, Aktivitäten, Methoden, Ergebnisse) ........................................................................................... 729 22 Verzeichnis der Checklisten Checkliste 12-1: Kontrollen zum Konformitätsmanagement (Compliance) .......... 582 Checkliste 12-2: Kontrollen zum Kontinuitätsmanagement .................................... 599 Checkliste 12-3: Kontrollen zur Sicherheits-, Kontinuitäts- und Risikopolitik ..... 614 Checkliste 17-1: ReifegradmodellDr.-Ing. Müller ................................................................ 721 Checkliste 19-1: Minimalistische Sicherheit ............................................................... 731 © Springer Fachmedien Wiesbaden GmbH, ein Teil von Springer Nature 2018 K.-R. Müller, IT-Sicherheit mit System, https://doi.org/10.1007/978-3-658-22065-5 23 Verzeichnis der Beispiele Beispiel 8-1: Sicherheits-, kontinuitäts- und risikopolitische Leitsätze Versicherung....................................................................................... 244 Beispiel 8-2: Sicherheits-, Kontinuitäts- und Risikopolitik ................................. 253 Beispiel 10-1: Sicherheitskriterium Verfügbarkeit: Einflussfaktoren (Auszug) .............................................................................................. 275 Beispiel 10-2: Maßnahmen-Klassen-Matrix (MKM) .............................................. 277 Beispiel 11-1: Bedrohungslandkarte (Auszug) ....................................................... 285 Beispiel 11-2: Redundante Stromversorgung ......................................................... 297 Beispiel 11-3: Physische Sicherheitszonen (schematisch) ..................................... 309 Beispiel 11-4: Definition von Klassifizierungsstufen ............................................ 355 Beispiel 11-5: Risikoinventar (Auszug) ................................................................... 356 Beispiel 11-6: Bruttorisikomatrix.............................................................................. 360 Beispiel 12-1: Richtlinie Faxgeräte und Fax-Nutzung mit Einzel- anforderungen .................................................................................... 564 Beispiel 12-2: Richtlinie Drucker und Ausdrucke mit Einzelanforderungen .... 564 Beispiel 12-3: IKT-Benutzerordnung mit Einzelanforderungen .......................... 575 Beispiel 12-4: Richtlinie E-Mail-Nutzung mit Einzelanforderungen .................. 577 Beispiel 12-5: Richtlinie Internet-Nutzung mit Einzelanforderungen ................ 578 Beispiel 12-6: Richtlinie Datenschutzmanagement mit Einzelanforderungen .. 586 Beispiel 12-7: Richtlinie
Recommended publications
  • ECSO State of the Art Syllabus V1 ABOUT ECSO

    ECSO State of the Art Syllabus V1 ABOUT ECSO

    STATE OF THE ART SYLLABUS Overview of existing Cybersecurity standards and certification schemes WG1 I Standardisation, certification, labelling and supply chain management JUNE 2017 ECSO State of the Art Syllabus v1 ABOUT ECSO The European Cyber Security Organisation (ECSO) ASBL is a fully self-financed non-for-profit organisation under the Belgian law, established in June 2016. ECSO represents the contractual counterpart to the European Commission for the implementation of the Cyber Security contractual Public-Private Partnership (cPPP). ECSO members include a wide variety of stakeholders across EU Member States, EEA / EFTA Countries and H2020 associated countries, such as large companies, SMEs and Start-ups, research centres, universities, end-users, operators, clusters and association as well as European Member State’s local, regional and national administrations. More information about ECSO and its work can be found at www.ecs-org.eu. Contact For queries in relation to this document, please use [email protected]. For media enquiries about this document, please use [email protected]. Disclaimer The document was intended for reference purposes by ECSO WG1 and was allowed to be distributed outside ECSO. Despite the authors’ best efforts, no guarantee is given that the information in this document is complete and accurate. Readers of this document are encouraged to send any missing information or corrections to the ECSO WG1, please use [email protected]. This document integrates the contributions received from ECSO members until April 2017. Cybersecurity is a very dynamic field. As a result, standards and schemes for assessing Cybersecurity are being developed and updated frequently.
  • Iso 22301:2019

    Iso 22301:2019

    INTERNATIONAL ISO STANDARD 22301 Second edition 2019-10 Security and resilience — Business continuity management systems — Requirements Sécurité et résilience — Systèmes de management de la continuité d'activité — Exigences Reference number ISO 22301:2019(E) © ISO 2019 ISO 22301:2019(E) COPYRIGHT PROTECTED DOCUMENT © ISO 2019 All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of the requester. ISO copyright office CP 401 • Ch. de Blandonnet 8 CH-1214 Vernier, Geneva Phone: +41 22 749 01 11 Fax:Website: +41 22www.iso.org 749 09 47 Email: [email protected] iiPublished in Switzerland © ISO 2019 – All rights reserved ISO 22301:2019(E) Contents Page Foreword ..........................................................................................................................................................................................................................................v Introduction ................................................................................................................................................................................................................................vi 1 Scope ................................................................................................................................................................................................................................
  • En Iso 22300

    En Iso 22300

    Terminology in Crisis and Disaster Management CEN Workshop Agreement Georg Neubauer, AIT http://www.ait.ac.at Background . The FP7 project EPISECC develops a concept of a common information space including taxonomy building to improve interoperability between European crisis managers and stakeholders . EPISECC is mandated to provide the outcome of its research to international standardisation – involvement in CEN TC391 . Within the FP7 project DRIVER a standard on terminology in crisis management shall be developed (among multiple other goals) . DRIVER & EPISECC will jointly co-operate on this issue . Additional support is planned from the FP7 projects REDIRNET, SECINCORE and SECTOR (all dealing with interoperability) 2 Scope and Purpose . Provision of an overview of existing terminologies and definitions applied in multiple domains of crisis and disaster management . Overview on synonyms with the same or similar definitions . Overview on different definitions for the same term . Benefit: Support enhancement of mutual understanding of users/organizations applying different standards/taxonomies . Benefit: Potential long term perspective: enhanced use of most suitable terms and definitions arising from multiple sources 3 Scope and Purpose (Example) Domain Term Definition Standard/document Intended Users situation where widespread human, material, economic or environmental losses have occurred which exceeded the ability of the affected organization (2.2.9), community or society to respond and recover using its own resources Societal security disaster ISO 22300 (2012) not specified A serious disruption of the functioning of a community or a society involving widespread human, material, economic or environmental losses and impacts, which exceeds the ability of the affected community or society to cope using its own authorities, pratictioners not specified disaster resources.
  • Best Practices on Public Warning Systems for Climate-Induced

    Best Practices on Public Warning Systems for Climate-Induced

    Best practices on Public Warning Systems for Climate-Induced Natural Hazards Abstract: This study presents an overview of the Public Warning System, focusing on approaches, technical standards and communication systems related to the generation and the public sharing of early warnings. The analysis focuses on the definition of a set of best practices and guidelines to implement an effective public warning system that can be deployed at multiple geographic scales, from local communities up to the national and also transboundary level. Finally, a set of recommendations are provided to support decision makers in upgrading the national Public Warning System and to help policy makers in outlining future directives. Authors: Claudio Rossi Giacomo Falcone Antonella Frisiello Fabrizio Dominici Version: 30 September 2018 Table of Contents List of Figures .................................................................................................................................. 2 List of Tables ................................................................................................................................... 4 Acronyms ........................................................................................................................................ 4 Core Definitions .............................................................................................................................. 7 1. Introduction .........................................................................................................................
  • Risk Management in Crisis: Winners and Losers During the COVID-19 Pandemic/Piotr Jedynak and Sylwia Bąk

    Risk Management in Crisis: Winners and Losers During the COVID-19 Pandemic/Piotr Jedynak and Sylwia Bąk

    Risk Management in Crisis Risk management is a domain of management which comes to the fore in crisis. This book looks at risk management under crisis conditions in the COVID-19 pandemic context. The book synthesizes existing concepts, strategies, approaches and methods of risk management and provides the results of empirical research on risk and risk management during the COVID-19 pandemic. The research outcome was based on the authors’ study on 42 enterprises of different sizes in various sectors, and these firms have either been negatively affected by COVID-19 or have thrived successfully under the new conditions of conducting business activities. The anal- ysis looks at both the impact of the COVID-19 pandemic on the selected enter- prises and the risk management measures these enterprises had taken in response to the emerging global trends. The book puts together key factors which could have determined the enterprises’ failures and successes. The final part of the book reflects on how firms can build resilience in chal- lenging times and suggests a model for business resilience. The comparative anal- ysis will provide useful insights into key strategic approaches of risk management. Piotr Jedynak is Professor of Management. He works at Jagiellonian University in Cracow, Poland, where he holds the positions of Vice-Rector for Financial and HR Policy and Head of the Management Systems Department. He specializes in risk management, strategic management and management systems. He is the author of numerous publications, an auditor and consultant to many public and business organizations. Sylwia Bąk holds a PhD in Management Sciences.
  • Linee Guida Per Lo Sviluppo E La Definizione Del Modello Nazionale

    Linee Guida Per Lo Sviluppo E La Definizione Del Modello Nazionale

    Linee guida per lo sviluppo e la definizione del modello nazionale di riferimento per i CERT regionali AGID 13 feb 2020 Indice 1 Premessa 3 2 Riferimenti 5 2.1 Leggi...................................................5 2.2 Linee Guida e Standard.........................................5 3 Definizioni e Acronimi 7 4 Contesto 9 4.1 Quadro di riferimento nazionale.....................................9 4.2 Impianto normativo applicabile ai CERT................................ 12 4.3 Organismi a supporto della Cyber Security............................... 18 4.4 Standard per la Cyber Security...................................... 21 5 Introduzione ai CERT 31 5.1 CERT: significato e definizioni generali................................. 31 5.2 Categorie di CERT............................................ 32 5.3 Mission dei CERT............................................ 32 5.4 Identificazione della constituency.................................... 33 5.5 CERT regionali.............................................. 34 6 Modello organizzativo 39 6.1 Modello indipendente.......................................... 39 6.2 Modello incorporato........................................... 41 6.3 Modello campus............................................. 43 7 Modello amministrativo 45 8 Servizi 47 8.1 Modelli di classificazione dei servizi.................................. 47 8.2 Servizi offerti dai CERT Regionali.................................... 50 9 Processo di gestione degli incidenti di sicurezza 57 9.1 Definizioni...............................................
  • WORK PROGRAMME of General Directorate of Standardization - ALBANIA (Period 1 July to 31 December 2018)

    WORK PROGRAMME of General Directorate of Standardization - ALBANIA (Period 1 July to 31 December 2018)

    WORK PROGRAMME of General Directorate of Standardization - ALBANIA (Period 1 July to 31 December 2018) Technical Committee No. 1 “Quality assurance and social responsibility”, 11 standards No. Standard number English title 1. EN ISO 22300:2018 Security and resilience - Vocabulary (ISO 22300:2018) 2. CEN/TS 17159:2018 Societal and citizen security - Guidance for the security of hazardous materials (CBRNE) in healthcare facilities 3. EN ISO 9004:2018 Quality management - Quality of an organization - Guidance to achieve sustained success (ISO 9004:2018) 4. CWA 17145-2:2017 Ethics assessment for research and innovation - Part 2: Ethical impact assessment framework 5. CWA 17145-1:2017 Ethics assessment for research and innovation - Part 1: Ethics committee 6. EN ISO 41011:2018 Facility management - Vocabulary (ISO 41011:2017) 7. EN ISO 41001:2018 Facility management - Management systems - Requirements with guidance for use (ISO 41001:2018) 8. IWA 18:2016 Framework for integrated community-based life-long health and care services in aged societies 9. IWA 16:2015 International harmonized method(s) for a coherent quantification of CO2e emissions of freight transport 10. ISO/IEC Guide 17:2016 ISO/IEC Guide 17:2016Guide for writing standards taking into account the needs of micro, small and medium-sized enterprises 11. ISO 37500:2014 Guidance on outsourcing Technical Committee No. 3 “Electrical and electronical materials”, 59 standards No. Standard number English title 1. EN 50288-12-1:2017 Multi-element metallic cables used in analogue and digital communications and control - Part 12-1: Sectional specification for screened cables characterised from 1 MHz up to 2 000 MHz - 1 Horizontal and building backbone cables 2.
  • Mandate M/487 to Establish Security Standards Final Report Phase 2

    Mandate M/487 to Establish Security Standards Final Report Phase 2

    In assignment of: European Commission DG Enterprise and Industry Security Research and Development Mandate M/487 to Establish Security Standards Final Report Phase 2 Proposed standardization work programmes and road maps NEN Industry P.O. Box 5059 2600 GB Delft Vlinderweg 6 2623 AX Delft The Netherlands T +31 15 2690135 F +31 15 2690207 [email protected] www.nen.nl Netherlands Standardization Institute M/487 has been accepted by the European Standards Organizations (ESOs). The work has been allocated to CEN/TC 391 ‘Societal and Citizen Security’ whose secretariat is provided by the Netherlands Standardization Institute (NEN). Mandate M/487 to Establish Security Standards Final Report Phase 2 Proposed standardization work programmes and road maps REPORT VERSION REPORT DATE Final report 05-07-2013 The copyright on this document produced in the Although the utmost care has been taken with framework of M/487 response, consisting of this publication, errors and omissions cannot be contributions from CEN/TC 391 and other security entirely excluded. The European Committee for stakeholders shall remain the exclusive property of Standardization (CEN) and/or the members of CEN and/or CENELEC and/ or ETSI in any and all the committees therefore accept no liability, not countries. even for direct or indirect damage, occurring due to or in relation with the application of publications issued by the European Committee for Standardization (CEN). Contents Page Executive summary ...........................................................................................................................................
  • D955.11 – Report on Existing Standards and Standardization Activities in Crisis Management Sp95 - Impact, Engagement and Sustainability March 2018 (M47)

    D955.11 – Report on Existing Standards and Standardization Activities in Crisis Management Sp95 - Impact, Engagement and Sustainability March 2018 (M47)

    D955.11 – REPORT ON EXISTING STANDARDS AND STANDARDIZATION ACTIVITIES IN CRISIS MANAGEMENT SP95 - IMPACT, ENGAGEMENT AND SUSTAINABILITY MARCH 2018 (M47) This project has received funding from the European Union’s 7th Framework Programme for Research, Technological Development and Demonstration under Grant Agreement (GA) N° #607798 DRIVER+ project D955.11 – Report on existing standards and standardization activities in crisis managementD955.11 – Report on existing standards and standardization activities in crisis management March 2018 (M47) Project information Project Acronym: DRIVER+ Project Full Title: Driving Innovation in Crisis Management for European Resilience Grant Agreement: 607798 Project Duration: 72 months (May 2014 - April 2020) Project Technical Coordinator: TNO Contact: [email protected] Deliverable information Deliverable Status: Final Deliverable Title: D955.11 – Report on existing standards and standardization activities in crisis management Deliverable Nature: Report (R) Dissemination Level: Public (PU) Due Date: March 2018 (M47) Submission Date: 02/04/2018 Sub-Project (SP): SP95 - Impact, Engagement and Sustainability Work Package (WP): WP955 - Standardisation activities Deliverable Leader: DIN Reviewers: Francisco Gala, ATOS. Klaudia, Tani, EOS File Name: DRIVER+_D955.11_Report_on_existing_standards_and_standardisation_activitie s_in_crisis_management.docx DISCLAIMER The opinion stated in this report reflects the opinion of the authors and not the opinion of the European Commission. All intellectual property rights are owned by the DRIVER+ consortium members and are protected by the applicable laws. Except where otherwise specified, all document contents are: “©DRIVER+ Project - All rights reserved”. Reproduction is not authorised without prior written agreement. The commercial use of any information contained in this document may require a license from the owner of that information. All DRIVER+ consortium members are also committed to publish accurate and up to date information and take the greatest care to do so.
  • DRIVER+ Portfolio of Solutions Database and Guidance Tool

    DRIVER+ Portfolio of Solutions Database and Guidance Tool

    This project has received funding from the European Union’s 7th Framework Programme for Research, Technological Development and Demonstration under Grant Agreement (GA) N° #607798 DRIVER+ project ◼ D933.21 DRIVER+ PoS database and guidance tool prototypes ◼ July 2019 (M63) Project Acronym: DRIVER+ Project Full Title: Driving Innovation in Crisis Management for European Resilience Grant Agreement: 607798 Project Duration: 72 months (May 2014 - April 2020) Project Technical Coordinator: TNO Contact: Deliverable Status: Final Deliverable Title: D933.21 DRIVER+ PoS database and guidance tool prototypes Deliverable Nature: Prototype (P) Dissemination Level: Public (PU) Due Date: July 2019 (M63) Submission Date: 17/07/2019 Subproject (SP): SP93 - Solutions Work Package (WP): WP933 - DRIVER+ online platforms Deliverable Leader: Denis Havlik, AIT Héctor Naranjo Setién, GMV Reviewers: Maurice Sammels, XVR Erik Vullings, TNO File Name: DRIVER+_D933.21 DRIVER+ PoS database and guidance tool prototypes.docx Version of template used: V2.2 – February 2019 DISCLAIMER The opinion stated in this report reflects the opinion of the authors and not the opinion of the European Commission. All intellectual property rights are owned by the DRIVER+ consortium members and are protected by the applicable laws. Except where otherwise specified, all document contents are: “©DRIVER+ Project - All rights reserved”. Reproduction is not authorised without prior written agreement. The commercial use of any information contained in this document may require a license from the owner of that information. All DRIVER+ consortium members are also committed to publish accurate and up to date information and take the greatest care to do so. However, the DRIVER+ consortium members cannot accept liability for any inaccuracies or omissions nor do they accept liability for any direct, indirect, special, consequential or other losses or damages of any kind arising out of the use of this information.
  • Business Continuity and Disaster Recovery Plan for Information Security Vyshnavi Jorrigala St

    Business Continuity and Disaster Recovery Plan for Information Security Vyshnavi Jorrigala St

    St. Cloud State University theRepository at St. Cloud State Culminating Projects in Information Assurance Department of Information Systems 12-2017 Business Continuity and Disaster Recovery Plan for Information Security Vyshnavi Jorrigala St. Cloud State University, [email protected] Follow this and additional works at: https://repository.stcloudstate.edu/msia_etds Recommended Citation Jorrigala, Vyshnavi, "Business Continuity and Disaster Recovery Plan for Information Security" (2017). Culminating Projects in Information Assurance. 44. https://repository.stcloudstate.edu/msia_etds/44 This Starred Paper is brought to you for free and open access by the Department of Information Systems at theRepository at St. Cloud State. It has been accepted for inclusion in Culminating Projects in Information Assurance by an authorized administrator of theRepository at St. Cloud State. For more information, please contact [email protected]. Business Continuity and Disaster Recovery Plan for Information Security by Vyshnavi Devi Jorrigala A Starred Paper Submitted to the Graduate Faculty of Saint Cloud State University in Partial Fulfillment of the Requirements for the Degree, of Master of Science in Information Assurance December, 2018 Starred Paper Committee: Susantha Herath, Chairperson Dien D. Phan Balasubramanian Kasi 2 Abstract Business continuity planning and Disaster recovery planning are the most crucial elements of a business but are often ignored. Businesses must make a well-structured plan and document for disaster recovery and business continuation, even before a catastrophe occurs. Disasters can be short or may last for a long time, but when an organization is ready for any adversity, it thrives hard and survives. This paper will clearly distinguish the difference between disaster recovery plan and business continuity plan, will describe the components of each plan and finally, will provide an approach that organizations can follow to make better contingency plan so that they will not go out of business when something unexpected happens.
  • Document Number Title Most Recent Publication Date Scope Sector 1 Sector 2 Sector 3 Sector 4 Contents

    Document Number Title Most Recent Publication Date Scope Sector 1 Sector 2 Sector 3 Sector 4 Contents

    Document Number Title Most Recent Scope Sector 1 Sector 2 Sector 3 Sector 4 Contents Publication Date ARINC 654 ENVIRONMENTAL DESIGN 9/12/1994 Refers electromagnetic Transportation Systems 1.0 INTRODUCTION GUIDELINES FOR compatibility, shielding, 1.1 Objectives INTEGRATED MODULAR thermal management, 1.2 Scope AVIONICS PACKAGING AND vibration and shock of IMA 1.3 References INTERFACES systems. Emphasis is placed 2.0 VIBRATION AND SHOCK both on the design of IMA 2.1 Introduction components and their 2.2 Vibration and Shock Isolation electrical, optical and electro- 3.0 THERMAL CONSIDERATIONS mechanical interfaces. 3.1 Thermal Management 3.1.1 Electronic System Thermal Design Objectives 3.1.2 Design Condition Definitions 3.1.3 Air Flow 3.1.4 Fully Enclosed and Flow- Through Cooling 3.1.5 Thermal Design Conditions 3.1.6 Cooling Hole Sizes - Limit Cases 3.2 Electronic Parts Application 3.3 Ambient Temperatures 3.4 Equipment Sidewall Temperature 3.5 LRM Thermal Appraisal 3.6 Thermal Interface Information 3.7 Materials for Thermal Design 4.0 DESIGN LIFE 4.1 Operational Design Life 4.2 Failure Modes ARINC 666 ITEM 7.0 Encryption and 2002 Information Technology f l/ Authentication ATIS 0300100 IP NETWORK DISASTER 1/12/2009 Pertains to enumerate Information Technology Emergency Services RECOVERY FRAMEWORK potential proactive or automatic policy-driven network traffic management actions that should be performed prior to, during, and immediately following disaster conditions. ATIS 0300202 Internetwork Operations 1/11/2009 Describes the cooperative Information Technology Emergency Services communications Guidelines for Network network management Management of the Public actions (that may be) Telecommunications required of interconnected Networks under Disaster network operators during Conditions emergency conditions associated with disasters that threaten life or property and case congestion in the public telecommunications networks.