Reference Architecture for the Operationalization of a BCMS Boban Kr - - PowerPoint PPT Presentation

reference architecture for the operationalization of a
SMART_READER_LITE
LIVE PREVIEW

Reference Architecture for the Operationalization of a BCMS Boban Kr - - PowerPoint PPT Presentation

Reference Architecture for the Operationalization of a BCMS Boban Kr i , Chief Information Security Officer verinice.XP - Berlin, 07. February 2017 DENIC Mission Founded in 1996 as a cooperative in Frankfurt / Main. Act as a


slide-1
SLIDE 1

Reference Architecture for the Operationalization of a BCMS Boban Kršić, Chief Information Security Officer verinice.XP - Berlin, 07. February 2017

slide-2
SLIDE 2

DENIC – Mission

  • Founded in 1996 as a cooperative in Frankfurt / Main.
  • Act as a neutral, non-discriminating and independent registry service

provider for the German Internet community according to RFC 1591.

  • Members are companies registering .de domains for their customers.
  • Organized as an open not-for-profit institution, each member has equal

rights (one member – one vote).

  • Government-independent and not regulated.
  • Guarantee the highest possible level of both quality as well as technical

stability and security.

2

slide-3
SLIDE 3

DENIC – Nameservice for .de

  • 19 own name server locations and 35+

complementary anycast locations worldwide

  • > 40.000 name server queries per second; peak

110.000 name server queries per second

3

slide-4
SLIDE 4

DENIC – International Collaboration

  • Active involvement in various bodies to

shape the further development of the Internet

  • Council of European TLD-Registries (CENTR)
  • Deutscher CERT-Verbund
  • DNS-Operations, Analysis and Research Center (DNS-OARC)
  • Internet Corporation for Assigned Names and Numbers (ICANN)
  • Internet Governance Forum (IGF)
  • Internet Engineering Task Force (IETF)
  • Internet Society (ISOC)
  • RIPE Network Coordination Centre (RIPE NCC)
  • Further development of Internet standards
  • Support of the collaboration between ccTLDs

4

slide-5
SLIDE 5

Business Continuity Management

5

slide-6
SLIDE 6

Business Continuity Management

  • Why Business Continuity Management is important
  • to safeguard human life;
  • ensure survival of the organization;
  • enable effective decisions in case of crisis;
  • minimize loss of assets, revenue, and customers;
  • comply with legal requirements;
  • facilitate timely recovery of critical business

functions;

  • maintain organization reputation.

6

slide-7
SLIDE 7

Conway’s Law “Any organization that designs a system (defined broadly) will produce a design whose structure is a copy of the organization's communication structure.”

[Melvin Edward Conway, Datamation, April 1968]

7

*: Melvin E. Conway: How Do Committees Invent? In: F. D. Thompson Publications, Inc. (Hrsg.): Datamation. Band 14, Nr. 5, April 1968, S. 28–31 (english, melconway.com [05. February 2017]).

slide-8
SLIDE 8

Business Continuity Strategies

8

slide-9
SLIDE 9

Business Continuity Planning – Exercise – 2010

9

slide-10
SLIDE 10

Business Continuity Planning – Exercise – Conclusion

10

slide-11
SLIDE 11

ISO 22301: Business Continuity Management System

  • Organization / Roles & Responsibilities
  • Developing Business Continuity Strategies
  • Risk Evaluation & Control
  • Business Impact Analysis
  • Crisis Communications
  • Coordination with External Agencies
  • Emergency Preparedness & Response
  • Awareness & Training Programs
  • Developing & Implementing BCPs
  • Business Continuity Plan Exercise, Audit & Maintenance

11

slide-12
SLIDE 12

BCMS – Strategic Level

  • Corporate (Organization) Strategy
  • DENIC’s Vision and Mission
  • Scope of BCMS ó Scope of ISMS
  • Integrated Approach
  • Business Continuity Management (ISO 22301)
  • Information Security Management (ISO/IEC 27001)
  • Risk Management (ISO/IEC 27005)
  • Policy and Management Review
  • Roles, Responsibilities and Authorities

12

slide-13
SLIDE 13

Risk Evaluation & Control

  • Risk Management Process
  • Business Impact Analysis (BIA)

13

slide-14
SLIDE 14

Business Impact Analyse (BIA)

14

*: Defining RTO, RPO and MTPOD (http://www.bcmpedia.org/w/images/8/83/Recovery_Objectives_RTO_RPO_and_MTPD.png) [05. February 2017].

slide-15
SLIDE 15

BCMS – Tactical Level

  • Prioritized Activity(ies) Recovery Strategy
  • Resource Recovery Strategy
  • Business Continuity Arrangements
  • Crisis Communication
  • Awareness Programme

15

slide-16
SLIDE 16

Business Continuity Strategies

  • Business Continuity Approaches:
  • Recovery Protection: (non-critical) implementing

prioritized actions to return business functions to

  • peration following a disaster.
  • Continuity Protection (critical): implementing

advanced actions to respond to a disaster in a manner that critical business functions continue without any interruption.

16

slide-17
SLIDE 17

Conway’s “clean slate" approach Conway's insight suggests a "clean slate" approach to alignment:

1. Define the business mission;

  • 2. Learn the business processes from business
  • wners;
  • 3. Reengineer these business processes to fit the

mission; and

  • 4. Structure the IT organization to support the

reengineered business processes.

17

*: David Dikel, David Kane: Conway’s Law Revisited. Successfully Aligning Enterprise Architecture. In: informIT. Prentice Hall PTR, 1. Mai 2002 (english, smu.edu [PDF; 05. February 2017].

slide-18
SLIDE 18

Availability Environment Classification (AEC)

18 Disaster Tolerant – Business functions must be ensured available in all circumstances. Fault Resilient – Business functions that require uninterrupted computing services, either during essential time periods, or during most hours of the day and most days

  • f the week throughout the year.

High Availability – Business functions that allow minimally interrupted computing services, either during essential time periods. Highly Reliable – Business functions that can be interrupted as long as the availability of the data is insured. Conventional – Business functions that can be interrupted and where the availability of the data is not essential. Fault Tolerant – Business functions that demand continuous computing and where any failure is transparent to the user. This means no interruption of work; no transactions lost; no degradation in performance; and continuous 24x7 operation.

  • hot standby platform,
  • synchronous data disk mirroring
  • DR location(s)
  • hot standby platform
  • synchronous data disk mirroring
  • hot/warm standby platform
  • (a)synchronous disk mirroring
  • hot/warm standby platform
  • synchronous backup (tape or disk)
  • warm/cold standby platform
  • asynchronous backup (tape or disk)

Recovery Strategy

  • none or cold standby platform
  • no backup

Availability Class

RTO: sec. – min. RPO: null RTO: hours RPO: sec. – min. RTO: hours RPO: hours RTO: hours RPO: hours – days RTO: days – weeks RPO: none RTO: sec. – min. RPO: sec. – min.

Indicative RPO/RTO*

AEC-0 AEC-1 AEC-2 AEC-3 AEC-4 AEC-5

*: Harvard Research Group (HRG) Availability Environment Classification (AEC) - http://www.hrgresearch.com/pdf/AEC%20Defintions.pdf [05. February 2017].

slide-19
SLIDE 19

AEC – Recovery Strategies

19

AEC-4

Fault Tolerant

AEC-3

Fault Resilient

AEC-1

Highly Reliable

SAN TL SAN TL Incident Incident Incident Incident Emergency <0,25*N Emergency

  • Emergency ³0,25*N
  • Crisis
  • Disaster

Emergency<1*N warm standby hot standby Failover cold standby

Manual intra- / inter-DC failover for spare capacities from:

  • basic services or
  • technical services

Backup DC Production DC

explanation

  • Emergency ³1*N
  • Crisis
  • Disaster
  • Emergency
  • Crisis
  • Disaster

a utomatic m anual a a a a a m a a a m SAN SAN SDS SDS ADS

slide-20
SLIDE 20

BCMS – Operational Level

  • Operational Planning and Control
  • Business Continuity Plan(s)
  • Incident Management
  • Exercising and Testing
  • Training and Competence
  • Maintenance

20

slide-21
SLIDE 21

Cultural Change – DevOps

21

Continuous Flow & Visibilty Lean & Agile Principles Product Centric

System Flow Amplify Feedback Loops Continuous Experimentation

PRACTICES CULTURE

Monitor Everything Continuous Delivery Automated Infrastructure Continuous Integration Automated Testing Version Control Everything High Trust Innovative Performance Oriented Empowered Associates Reduce Variation High Cooperation

Reduce Lead Time for Change

DEVOPS

Business Enabling Responsiveness

*: The Simple Math of DevOps, Lee Reid, 2015 https://devops.com/interconnect- 2016-culture-matters [05. February 2017].

slide-22
SLIDE 22

DNS Services

DevOps – Cross-Functional Service Teams

22

Hardware, Data Center, Client Support

Community Services

Infrastructure Services

Web Services Registry Services Office Services

slide-23
SLIDE 23

Principles for System Design

  • Full-Stack-Automation
  • Easy
  • Repeatable
  • Secure
  • Up-to-date
  • Homogenous

23

slide-24
SLIDE 24

DENIC Services – Pipelines and Staging

24

Production Test Commit

DENIC Services Infrastructure Services

slide-25
SLIDE 25

Registry Services – Pipelines and Staging

25

slide-26
SLIDE 26

DNS Service – Pipelines and Staging

26

slide-27
SLIDE 27

BCM Deployment Strategies

  • Blue-Green-Deployment

27

  • Serial Deployment

*: Blue Green Deployment https://martinfowler.com/bliki/BlueGreenDeployment.html [05. February 2017]. *: Deployment Strategies for Distributed Applications on Cloud ComputingInfrastructures, University of Amsterdam [05. February 2017].

slide-28
SLIDE 28

B/G Deployment FRA to AMS

28

slide-29
SLIDE 29

Monitoring – Registry Services - whois

29

slide-30
SLIDE 30

BCMS – DENIC –2016

30 0,0 1,0 2,0 3,0 4,0 Scope of BCMS BCMS Policy Roles, Responsibilities and Authorities Assurance Business Impact Analysis (BIA) Risk Management Corporate (Organisation) Strategy Prioritised Activity(ies) Recovery Strategy Resource Recovery Strategy Operational Planning and Control Training and Competence Communication Incident Management Awareness Programme Business Continuity Plan(s) Exercising and Testing Maintenance Business Continuity Arrangements Management Review

slide-31
SLIDE 31

Questions ?

Thank You ! Contact:

Boban Kršić <krsic@denic.de> PGP Key-ID: 0x43C89BA9

31