Business Enhancement Associates Aha! Moments: Disaster Planning

Showing posts with label Disaster Planning. Show all posts

Friday, September 6, 2013

How Small Businesses Should Plan for Disasters

Photograph by Blake Sell/AP Images

Sveinn Storm pumping water out of his flooded store, Storm Bros. Ice Cream Factory, in October 2012 in Annapolis, Md.

Businessweek:
By Karen E. Klein September 06, 2013

Question: After Hurricane Sandy, I didn’t even have time to think about preparing for the next disaster. Now that my business is finally running smoothly again, I’d like to prepare in case another major storm hits. What should I be doing?

Image via CrunchBase

Answer: You’re ahead of the game, since your business has survived one major disaster and you’re familiar with what it takes to recover and reopen. The U.S. Small Business Administration estimates that one-quarter of businesses that are hit by disaster fail as a result.

Even after coming through a catastrophe—whether it be a hurricane, fire, or terrorist attack—some small business owners don’t prepare for the next one, says Bob Risk (yes, it’s his real name), who owned a 65-employee disaster cleanup business for 18 years and now works as a safety expert for Staples (SPLS). “I’ve seen people get hit with a flood, fight to get back into business, talk about how terrible it was, and then three months or three years go by and the exact same thing happens—and they haven’t taken any measures to deal with it.”

BLOG: What Happened to Small Businesses Walloped by Hurricane Sandy?

SBA opens Disaster Loan Center in Austell, GA, October 26, 2009 (Photo credit: Wikipedia)

If you’re worried that disaster prep will be costly and time-consuming, those fears are unfounded, says Bob Boyd, president and chief executive of Agility Recovery, based in Charlotte, N.C. Small steps can make a big difference. “Don’t get paralyzed by worrying about big solutions that are expensive when it’s easy to knock off the low-hanging fruit,” he says.

English: Martinsville, IN, June 13, 2008 -- U.S. Small Business Administration (SBA), Deputy Administrator, Jovita Carranza, offers aid and advice to a Hoosier family after flooding in southern Indiana, at a Disaster Recovery Center (DRC). Barry Bahler/FEMA (Photo credit: Wikipedia)

Boyd recommends you start at the SBA’s disaster planning site and think through the three major problems that result from disasters: loss of power, loss of communications, and loss of property. “If you can take phone calls and keep production going, you’ll be light years ahead of your competitors. Your customers will never come back to you if your business fails them. But everyone will come to you—and they’ll never leave—if you prove your business to be successful and trustworthy,” he says.

Here’s what to do:

STORY: The Disaster Response Industry's Salesmen of the Apocalypse

English: Goldsboro, NC, October 6, 1999 -- Michael C. Allen of the U.S. Small Business Administration, explains recovery programs at a forum recently held in Goldsboro, NC. The SBA works in partnership with FEMA to assist the victims of disaster. Photo By DAVE SAVILLE/ FEMA News Photo (Photo credit: Wikipedia)

Plan for power loss. Talk to an electrician about what kind of generator you would need to power your business and how to get one in a hurry. “Most business people don’t know what they would need if they had to find a generator someplace,” Boyd says. If you plan ahead, he says, “as soon as you lose power, you can make one call and get one.”

Plan to communicate. With power down, you may not be able to rely on electronic devices or have access to important contact information. “Make sure your employees know how to reach you and how you’ll communicate with them in an

English: Findlay, Ohio, September 20, 2007 -- Small Business Administration (SBA) representative Gilbert YingLing (L) listens to Brian Wilkins, a local business owner whose glass company suffered extensive damage in recent flooding. SBA contacts local business owners as part of their Disaster Outreach Program. John Ficara/FEMA (Photo credit: Wikipedia)

emergency, whether it’s on Facebook (FB), Twitter, or through text messages,” Boyd says. Print out important phone numbers, bank account numbers, credit-card numbers, and any other information that is critical to your operation and update it regularly. Then put hard copies in several locations and make sure your staff knows where they are located.

Plan to keep working. Your final major hurdle will be finding a place to work if your location is under water or otherwise inaccessible. “Think through where you’re going to go, and don’t just rely on a work-from-home strategy,” Boyd says. “If your office is dark and unconnected, your home may be also. Come up with some remote locations where you can relocate temporarily, perhaps setting up a reciprocal arrangement with a business or a friend in another city.”

BLOG: The SBA’s Role as Home Lender, Post-Oklahoma Tornado

Buy basic supplies. It’s easy to purchase emergency preparedness kits and keep them in your office, your home, and your car. They can be expensive, though, and will probably include many items you don’t really need. “Grabbing an old duffel bag and throwing some basic things in there can meet your requirements just as effectively,” Risk says.

What should be in it? Risk suggests crank-powered radios, flashlights, and cell-phone chargers; heavy-duty extension cords; emergency water; mylar blankets and inexpensive ponchos; and rubber boots that can be pulled over your shoes. Don’t forget easy to carry emergency food, such as high-calorie energy bars with long shelf-lives. And, for 50¢ or $1 each, glow sticks on lanyards provide 12 hours of light in case you need to evacuate your employees or walk home after dark.

Prepare your employees. “Designate a disaster preparedness point person, or team, to spearhead the planning efforts,” Esmail Hozour, chief executive of Palo Alto (Calif.)-based Etón, which sells preparedness products, writes in an e-mail. That team should set up an area for employees to meet in your building or outside it; maintain an updated list of employees to make sure everyone is safe and accounted for after a disaster; display emergency contact information in a central location in your workplace, and encourage your staff to enroll in first aid and CPR classes, paid for by your company.

STORY: The Importance of Disaster Plans

Check out some additional resources: The Independent Community Bankers of America, a trade group representing 7,000 community banks, lists financial preparedness tips on its website. The SBA is hosting three free webinars this month on disaster preparedness for small businesses.

Klein is a Los Angeles-based writer who covers entrepreneurship and small-business issues.

'via Blog this'

Wednesday, February 6, 2013

Ten Tips That Could Prevent Cyber Criminals from Hijacking Client Data

WealthManagement.com:

Feb. 1, 2013Megan Leonhardt

Image via CrunchBase

As tablet ownership continues to grow—doubling since 2011—and more than half of U.S. consumers owning a smartphone, according to a 2013 Forrester Research report, advisors need to be more vigilant about data security now more than ever. Below are 10 easily implemented safeguards that could prevent advisors becoming an easy target for cyber thieves.

Spicy Stories (July 1929) -- Don't Show Everything !! ... Americans still lax with Wi-Fi security: survey -- "Anyone can see everything you are doing," Whitman finished her sentence. (November 7, 2011) ... (Photo credit: marsmet463)

1. Nothing Is Free—Avoid using public Wi-Fi whenever possible, warned financial services
technology expert, Bill Winterberg. Using a smartphone’s cellular network ... is more secure, he advised, saying that using a cellular network is going to make it more difficult for hackers to “snoop.”

English: How doses work a VPN ? Français : Comment fonctionne un VPN ? (Photo credit: Wikipedia)

2. Look Into VPN Options—VPNs, or virtual private networks, act like a tunnel through the Internet, remotely connecting your computer to a secure server. Using a VPN connection ensures that all Internet communication is encrypted and protected against unwanted probing.

Many companies offer employee access to an internal VPN, but advisors can also check out independent services including TorVPN and Private Internet Access. ...

3. Stay Logged On At Your Peril—... [Not] logging out means that cyber crooks intent on accessing your unprotected Internet sessions could stay on longer, increasing the potential danger, Winterberg says. ...

4. Keep Up-To-Date—Advisors should be updating their software and apps as often as possible, especially when those updates that include security improvements. ...

5. Forewarned Is Forearmed—A security system is only as good as its weakest link, says John Sileo, founder of Silio.com and a speaker on privacy and data security. Advisors should train staff to use best data security practices and recognize potential threats such as spear phishing attacks—emails that may deliver malware software to your computer or mobile devices.

“The number one way we see data stolen is that someone inside his organization is socially engineered out of the data,” Sileo says. Plus, staff training is comparatively cheaper than the estimated $300 per record lost in an average data breach.

6. Triple Check—Even with staff training, advisors should have redundancies in place to keep cyber thieves from impersonating clients, says Adam Levin, former director of the New Jersey Division of Consumer Affairs and co-founder of Credit.com and Identity Theft 911. Although many clients use email—which Leven calls an “inherently unsecure conduit”—to regularly communicate [with] their advisor, there should be a system in place to verify the identity of a client, including follow-up phone calls or in-person meetings. ...

Harris Interactive (Photo credit: Wikipedia)

7. Responsible Safeguards—...Envision a “scorched earth” policy when it comes to password protection, as in, no device is exempt, including personal phones and tablets. Approximately 81 percent of employees use at least one personal device such as a tablet or smartphone for business use, according to a 2012 Harris Interactive survey. ...

8. Solid Defenses—Not only should advisors use passwords, they also need to use passwords that are long—generally at least six to nine characters—without having personal details such as birthday, age or social security numbers worked in.

Go beyond the typical 4-digit automatic password option available on smartphones, says Winterberg. While it’s inconvenient to have a long password, the 4-digit approach does not provide enough defense against a “brute force” attack.

9. Think Disposable—At the end of the day, smartphones and to some extent, tablet devices, should be treated as throwaway devices. All information stored on the device needs to be backed up in case something should happen, including loss and theft.

“The most important thing is that people need to look at their mobile device and realize that it is not a communication device, it’s a data storage device,” Levin says.

10. Wipe It Clean—While the Find My iPhone app is designed for iPhone users, there are also similar Android versions on the market. Every data security interviewed for this article recommended that advisors have a version on their mobile devices.

Not only can the app help find the phone or tablet if it’s activated, but the app has a “destroy after reading”-like capability that erase all data on the device in case of emergency.

“You can never be too safe,” Levin said, adding that cyber attacks are only going to become more sophisticated and more damaging as technology improves.

'via Blog this'

Tuesday, November 6, 2012

A Flare for Risk

"A severe solar storm can cripple electrical grids, wreak havoc on our economy and cause trillions of dollars in damage and supply chain interruptions. Think it can't happen? It did in 1859, and in just the last five years, the Earth has been dangerously close to being hit with solar flares. "

Risk & Insurance Online
October 15, 2012
By Kyle Beatty and Nicole L. Homeier

"Never say never" is a well-known axiom ... but it applies perhaps most dramatically to the potential for catastrophic weather events. Although infrequent, they do happen -- at times with devastating results.

IN SPACE - JANUARY 23: In this handout from the NOAA/National Weather Service's Space Weather Prediction Center, shows a solar flare erupting from the sun late January 23, 2012. The flare is reportedly the largest since 2005 and is expected to affect GPS systems and other communications when it reaches the Earth's magnetic field in the morning of January 24. (Image credit: Getty Images via @daylife)

The most severe space weather event in recorded history -- known as the Carrington Event -- took place in 1859. The largest geomagnetic storm on record, it electrified transmission cables, set fires in telegraph offices, and produced Northern Lights so bright that people could read newspapers by the glow. If a similar storm occurred today, according to a report by the National Academy of Sciences, it could cause $1 trillion to $2 trillion in damages to society's high-tech infrastructure and require four to 10 years for complete recovery. By comparison, Hurricane Katrina caused "only" a fraction of that damage.

Quantifying the Risk from Severe Solar Storms

Just how frequent are these extreme storms? According to records of past events, the earth experienced one occurrence in the last 150 years. Therefore, one might conclude the yearly chance of occurrence is one in 150. Some estimates suggest there is a 12 percent chance for an extreme storm to occur within the next 10 years, according to space physicist Pete Riley, senior scientist at Predictive Science in San Diego, Calif., writing in Space Weather. But these estimates ignore the physical details of electric grid risk. As a result, Atmospheric and Environmental Research is currently working with several insurance carriers to establish a much more rigorous view on this.

Although our work is ongoing, we believe a Carrington-like event is not all that rare or even unlikely. ... In fact, severe space weather events have occurred much more recently. In March, the sun emitted the biggest solar flare in five years. Fortunately, the orientation of the solar storm's magnetic field meant it didn't damage electronic systems here on Earth. ... On July 23, a CME with a nearly unprecedented speed of 3400 km/s blasted from the Sun, and no matter the magnetic field direction, this would have a powerful impact on Earth. Again, we were lucky, the sunspot was facing away from Earth.

Power Outage (Photo credit: mrapplegate)

One famous example of the grid effect from space weather occurred during the early morning hours of March 13, 1989. A blast of magnetized plasma from the sun triggered a powerful geomagnetic storm. The storm spawned electric currents in the ground and in power lines -- currents that rapidly incapacitated key power grid components. A portion of the Hydro-Quebec power grid failed in a cascade fashion. Several key pieces of equipment sustained damage, including two transformers that had to be removed from service. On the same day throughout North America and the United Kingdom, electrical disturbances barraged power grids for several hours. In New Jersey, a $12 million generation step-up transformer at the Salem nuclear plant suffered permanent insulation damage. ... [Workers] were able to install a spare transformer within a "short" six-month time frame. Over the next two years, there were 12 transformer failures in North America suspected to have resulted from to the storm. The outage was a chilling reminder of our reliance on electrical power -- and the vulnerability of our grid to geomagnetic storms.

English: Simplified map of power distribution grid in United States with sections vulnerable to outage during to the larges geomagnetically induced current expected during 100 years of space weather. (Photo credit: Wikipedia)

One cause for heightened concern is that the average age of transformers is significantly higher now than it was in 1989, meaning that the damage would be greater from a repeat of this scale of event. Also, in the 23 years since the Quebec grid sustained damaged, global companies and regional economies have increased reliance on the electrical grid dramatically, meaning the impact today of a similar solar event could be even more drastic.

Artist's rendition of Earth's magnetosphere. (Photo credit: Wikipedia)

Strategies to Manage Risk

In some ways preparing for a space weather outage is similar to outages from other causes. Strategies risk managers can use to mitigate power outage include:

* backup generators for critical systems
* redundant and co-located software and data systems, especially for revenue, customer-facing, and customer service operations
* service interruption endorsements that cover utility outage
* alternate suppliers for critical components or services, if supply chain risks are not covered

Geomagnetic Storm In Progress (Photo credit: NASA Goddard Photo and Video)

A long-term electrical outage caused by space weather could last for a week, a month, or even a year. There is no way to prevent an outage from striking your company. In this scenario, the financial exposure to the insurance industry escalates to an enterprise level. Losses can accumulate from multiple coverages and lines, and movements in the broad financial markets are likely.

Insurers should start to address this issue by quantifying their company's financial exposure to service interruption events. ... AER scientists are now allowing risk managers to take a quantitative approach to evaluate the impact of both short-term and long-term power outages. In this context, short-term means hours or a day, with a recurrence interval of a few years.

C3-class Solar Flare Erupts on Sept. 8, 2010 [Video] (Photo credit: NASA Goddard Photo and Video)

At the primary insurer level, mitigation strategies for long-term outages might include:

* Review your company's policy language ...
* Implement loss control strategies, such as advising insureds to have preapproved business-continuity plans, including alternative locations for operations.
* Evaluate the adequacy of aggregate cover insurance currently in place.

The risk of a space weather-related power outage, for example, is lower in certain places in the United States. A company with multiple locations could have a business-continuity plan that includes relocation of critical functions to a safer area when the duration of the outage is uncertain. Data access at new locations is one of many factors to consider. Improved tools to quantify the risk open opportunities for carriers to provide new products or expanded coverages that previously were not feasible.

IN SPACE - JUNE 7: In this handout from NASA/Solar Dynamics Observatory, a solar large flare erupts off the sun June 7, 2011 in space. A large cloud of particles flew up and then was pulled back down to the sun's surface. According to NASA, the event is not suppose have any effect once the particles reach the earth on either June 8 or June 9. (Image credit: Getty Images via @daylife)

Beyond financial exposure, another challenge posed by power outages is communication. Insurers need to consider how their own internal operations will proceed during such an event. ... Corporate reputation -- including a clear demonstration of risk readiness -- should be part of the company's enterprise risk management plan.

When the next event strikes, companies that communicate pro-actively will establish themselves as trustworthy leaders in the eyes of their customers, employees, the media and local government.

Insurers must remember that although the chance of a long-term space weather outage is modest, they cannot disregard it. When a long-term outage does occur, the cost will be staggering. In short, the lesson here may be to "never say never again."

Kyle Beatty is vice president of the Business Solutions Division and Nicole L. Homeier is a staff scientist in remote sensing at Atmospheric and Environmental Research, a member of the Verisk Analytics family of companies.

Monday, July 9, 2012

Playing war games to prepare for a cyberattack

A poor response can be far more damaging than the attack itself.

McKinsey Quarterly
JULY 2012 • Tucker Bailey, James Kaplan, and Allen Weinberg

war games to prepare for cyberattacks article, war games show companies what needs protection from cyberattacks, Business Technology

“Can it happen to us?” All over the world, technology executives have been fielding this question from boards of directors and CEOs in the wake of highly publicized cyberattacks on large, well-respected companies and public institutions.

LulzSec (Photo credit: Wikipedia)

“Yes” is the only honest answer at a time when ever more value is migrating online, when business strategies require more open and interconnected technology environments, when attackers have always-expanding capabilities, and when attacks take advantage of limited security awareness among employees and customers. In fact, it may already have happened to you—but you may not know it.

Although political “hacktivists,” such as Anonymous and LulzSec, certainly delight in announcing their exploits to the world and causing embarrassment to their targets, other sophisticated attackers seek to cover their tracks. Organized-crime rings engaging in cyberfraud have no interest in letting their targets know they have been infiltrated.

An image that Anonymous has used to represent the operation; it contains elements of symbols used to represent both Anonymous and LulzSec. (Photo credit: Wikipedia)

We believe that boards and senior business leaders should be asking the technology team a different question—namely, “Are we ready to respond to a cyberattack?”

An ill-thought-out response can be far more damaging than the attack itself. … How much value is destroyed by the loss of sensitive business plans depends on the ability to adjust tactics quickly.

Testing readiness with cyberwar games

The armed forces have long conducted war games to test capabilities, surface gaps in plans, and build their leaders’ abilities to make decisions in real time. Some companies—3 percent, according to a recent McKinsey survey of digital business practices—have conducted cyberwar games to help ensure they are ready to manage a cyberattack. In fact, many corporate cyberwar-gaming efforts have been directly inspired by national-defense-oriented cyberwar games.

A cyberwar game is very different from traditional penetration testing, in which companies employ or contract with “white hat” hackers to identify technical vulnerabilities, such as unsecured network ports or externally facing programs that share too much information in the browser bar.

Information security (Photo credit: Wikipedia)

A cyberwar game is organized around a business scenario (such as cybercriminals using “spear phishing” attacks to target high-net-worth customers for fraud). It is structured to simulate the experience of a real attack. Participants receive incomplete information, and their objectives may not be 100 percent aligned. The simulation is cross-functional, involving participants from not only information security but also application development, technology infrastructure, customer care, operations, marketing, legal, government affairs, and corporate communications.

English: The Information Security triad: CIA. Second version (Photo credit: Wikipedia)

The cyberwar game occurs over a few days but requires up-front analysis of business-information assets and potential security vulnerabilities to make the scenario relevant and the game play realistic. The exercises usually do not affect live production systems; many cyberwar games are “tabletop” exercises.

Most important, a cyberwar game tests for flaws in a company’s ability to react to an attack by answering key questions about the capabilities required for a successful response:

Will the security team identify and assess the breach quickly? One organization found that the processes its security team used to address a breach were entirely dependent on e-mail and instant messaging; the organization would have limited ability to respond to an attack that compromised those systems.
Will the team make effective decisions in containing the breach? One corporation discovered that it did not have functional guidelines for deciding when to shut down parts of its technology environment. It found that senior executives would have ordered the technology team to sever external connectivity unnecessarily, thereby preventing customers from accessing their accounts.
Will the team effectively communicate the breach to the full set of stakeholders? At one financial institution, a war game demonstrated that guidelines had not been differentiated for communicating with customers whose data had been breached. As a result, high-net-worth customers would have received an impersonal e-mail.
Can the company adjust business strategies and tactics in the wake of a breach? At one manufacturer, a war game revealed that business managers had never thought through what they would do if competitors or counterparties gained access to sensitive information, and so would be unable to change negotiation strategies quickly after the disclosure of proprietary information about their cost structure.

Gaining insights from gaming

English: diagram showing threat agents, attack vectors, weakness, controls, IT asset and business impact (Photo credit: Wikipedia)

Cyberwar games yield insights into information assets that require protection, security vulnerabilities that attackers can exploit, and flaws (or “failure modes”) in a corporation’s ability to respond to an attack

Exhibit 1: Cyberwar games yield insights into security vulnerabilities and information assets.

The analysis required to develop relevant scenarios for the war game also facilitates a discussion between business and security managers about which risks and types of information assets are most important, who would want to compromise these information assets, and what the implications of an attack could be with regard to loss of intellectual property, loss of reputation, business disruption, or fraud. This information is not always clear before such a discussion. For example, one public institution found out that most of its IT-security processes were geared toward preventing online fraud, even though the biggest risk was the loss of confidence associated with a public breach.

Likewise, the analysis required to ensure that scenarios used in the game are realistic can, in turn, highlight important security risks. For instance, one retail brokerage discovered that most of its most sensitive information assets were hosted on applications that had not undergone security reviews and used out-of-date controls for authenticating users.

Conducting a cyberwar game

digital attack (Photo credit: Will Lion)

Most corporations can plan and conduct a game in 6 to 12 weeks, with a manageable impact on security, technology, and business managers’ time.

Aligning the scope and objectives of the war game is the first step. This includes deciding how many scenarios to incorporate into the game, how sophisticated those exercises will be, and how much participation will be required of the representatives of each business function who help design the game. These “trusted agents” develop potential scenarios that take into account critical information assets, attackers who would want to compromise them, and any existing security vulnerabilities they might exploit

Exhibit 2: Preparation for cyberwar games surfaces vulnerabilities that can then be tested.

After selecting the scenarios to be deployed in the game, the agents identify the failure modes they need to test for and create the step-by-step script that a facilitator—an internal or external war-gaming expert—uses when running the game. The simulation or game itself can last anywhere from a day to a week or more, depending on the complexity of the scenarios. Throughout the course of the simulation, the facilitator will provide participants with intermittent updates or new information on which they can act. At each turn, the data that the players representing functions like security, marketing, and legal receive depend on the actions they have just taken.

Own view of Enterprise Information Security Architecure(EISA) Framework. (Photo credit: Wikipedia)

The last and most important phase takes the insights generated by the simulation and converts them into actionable steps that will improve a corporation’s ability to respond to an attack. These steps typically include everything from implementing tools that increase an organization’s ability to foresee attacks, clarify responsibilities, and develop guidelines for making high-stakes decisions under pressure to creating communications protocols that can be pulled “off the shelf” when required.
Conducting a war game to test a corporation’s ability to manage a cyberattack requires genuine effort and planning. However, it is one of the most effective mechanisms for prioritizing which assets to protect, surfacing vulnerabilities, identifying flaws in a company’s ability to respond, and building the type of “muscle memory” required to make appropriate decisions in real time with limited information.

About the Authors

Tucker Bailey is an associate principal in McKinsey’s Washington, DC, office; James Kaplan is a principal in the New York office, where Allen Weinberg is a director.

Pages

Friday, September 6, 2013

How Small Businesses Should Plan for Disasters

Wednesday, February 6, 2013

Ten Tips That Could Prevent Cyber Criminals from Hijacking Client Data