From the course: CompTIA Security+ (SY0-701) Cert Prep

Business continuity controls

From the course: CompTIA Security+ (SY0-701) Cert Prep

Start my 1-month free trial

Business continuity controls

“

- [Narrator] Business continuity professionals have a variety of tools at their disposal to help remediate potential availability issues. One of the critical ways that IT professionals protect the availability of systems is ensuring that they're redundant. That simply means that they're designed in a way that a failure of a single component doesn't bring the entire system down. Business can continue in the face of a single, predictable failure. The single point of failure analysis process provides security professionals with a mechanism to identify and remove single points of failure from their systems. Let's look at an example. Here we have a simple web-based application, a web server protected by a firewall and connected to the internet. As we conduct a single point of failure analysis, we might first notice that the web server itself is a single point of failure. If anything goes wrong with that server, the web servers will stop functioning. We can correct the situation by replacing the single web server with a clustered farm of servers that are all designed to provide the same web service. The cluster is designed so that if a single server fails, the other servers will continue providing service without disruption. Once we've implemented the cluster, we've removed the server as a single point of failure. Next, we might turn our attention to the firewall, another single point of failure. If the firewall goes down, internet users will not be able to reach the web server, rendering the web service unavailable. Therefore, the firewall is also a single point of failure. We can correct that situation by replacing the firewall with a pair of high-availability firewalls, where one serves as a backup device, standing by to step in immediately if the primary firewall fails. By replacing the single firewall with a high-availability pair, we've removed the firewall as a single point of failure, but we have still yet another single point of failure here, the internal and external network connections. As with the web server and firewall, we can address this single point of failure by introducing redundancy and having two separate network connections for each link. If one fails, the service may continue to operate over the other. This single point of failure analysis may continue on identifying and remediating issues until either the team stops finding new issues, or the cost of addressing issues outweighs the potential benefit. This single point of failure analysis is an important part of an organization's continuity of operations planning efforts. Organizations should also consider the other risks facing their IT operations. As they conduct IT contingency planning, they should not only consider single points of failure, but also all the other situations that might jeopardize business continuity. For example, these might include the sudden bankruptcy of a key vendor, the inability to provide computing or storage capacity needed by the business, utility service failures, and any other risk that IT management believes may disrupt operations. And one final component of business continuity planning that's often overlooked is personnel succession planning. IT depends upon highly-skilled team members who develop, configure and maintain systems and processes. IT leadership should work with their human resources department to identify the team members who are essential to continued operations, and identify potential successors for those positions. That way when someone leaves the organization, management has already thought through potential replacements, and hopefully provided those successors with the professional development opportunities that they need to step into the departing employee's shoes.

Contents