Part of your planning is sitting down and essentially predicting and planning for your worst nightmare! Sounds bad, doesn’t it? Sitting down and thinking about a ‘series of unfortunate events’ isn’t something that makes us jump for joy. It is however essential to develop effective exercise scenarios… (they must be realistic, no alien scenarios allowed!)
As always, before sitting to think about all this, ensure you have clear objectives. A good exercise scenario achieves the following…
1. Offers a challenge. Real life isn’t always easy! However, ensure you can overcome challenges, they should not overwhelm you
2. Ensure the scenario helps you fulfil the objectives you have set
3. Educates all key players
4. Carries minimal risk and does not cause real disruptions (unless that is the aim!)
5. Creates lessons to learn
How can we know what to test? Start by getting your team together and jot down some realistic ideas! Let’s look at your ‘planks of support’ … That is, your business processes that simply can’t fail…
Test your People…
1. Access to Human Resource data
2. What potential points of failure exist
3. Staff awareness and their role during a disruption
4. How you would cope with the loss of staff expertise
Some concerns around testing your people include staff co-operation, the effectiveness of your audits, accountability and the process of identifying ‘good practice’!
Test the Workplace
1. Loss of critical features your workplace provides
2. Implications of having to relocate. This is a big one… what effect would this have on your employees?
Some concerns may include loss of equipment and records, inability to find an alternative premises and the simple fact of how your staff will react to your new site/location
Test your IT
1. Your back-up machinery, i.e. generators etc.
2. Can you effectively shut down your systems to prevent data loss?
3. What is the process around your callout contract with your IT provider?
4. Total system security
Some concerns may include how much do you depend on your IT systems. If your systems are down does it halt entire business activity? You may also want to think about your ability to identify critical business activities which may be jeopardised.
Other things to test include your communications and finance!
Just remember to start off with simple topics, hopefully some of the ideas I’ve listed here will help you along the way!
Follow Renaissance on LinkedIn / Twitter for daily cyber security news and updates