As an interactive document to establish precedence for network security, disaster recovery (DR), and business continuity (BC), a network security plan stands as a handbook for managing the direct and indirect periphery of the network supporting a financial organization and its digital infrastructure. When combining network threat models with business process documentation, an exemplary set of controls, knowledge, and documentation will enhance the security posture of the business and their cyber preparation.

The disaster recovery considerations will cover redundancy in network regions, replication of data, and automated backup services provided through cloud partners that supports failover policies. These closed loop systems will be secured with the highest levels of in-flight and at rest encryption, to secure data retention through real-time replication and distributed backup networks.

A business continuity set of objectives will operationalize the business if the event of a cyber-attack or natural disaster occurs. These set of processes will align with the on-demand need for services where the IT infrastructure supports core business operations, so that the business does not face the threat of depreciated services during an event outside of its control.

Objectives and goals

The financial organization’s network security plan will incorporate the business and information technology processes synergistically to prepare for a disastrous event, where systems that are critical to the business and vulnerable.

• The stability of the system will protect the data from sales and customers to card information, not only securing it from interception, but through a recovery strategy that prevents data loss.
• While storing data in the primary and secondary locations, each storage environment will replicate the security policies of the primary to retain compliance.
• As the system reroutes, restores, and traverses the network to recover through the self-healing lifecycle the process will be optimized with failover to reduce loss in business processes.
• When an event occurs, notifications across the system will inform the customers, enabling them a secure tunnel through additional verification during a cyber event to mitigate reputation and data loss.

In the event of need for disaster recovery and business continuity the objective of this plan is to provide a structural set of goals and procedures to maintain the operations of the business. When the event of a disaster arises, from human or environment, the set of goals in this plan will prioritize the core practices that assure a financial organization to continue through these impactful events.

In the focus of disaster recovery, the objective of the plan is to handle the situation in a manner that provides the least amount of disruption from the information technology side.

• An Incident response team will assemble to understand the scope and effect of the disaster, reducing the complexity of evaluation to focus in on remediation.
• Firewall and intrusion detection combined with security automation, provided through a security orchestration automation and response (SOAR) that automates analysis and automatically resolves incidents that are configured within security policies.

When the disaster strikes and the events are unfolding, it is the businesses’ objective to allow the prepared teams to handle the events and support the employees in continuing the business operation with continuity.

• Through clear protocols for employees, the standardization of the event will allow the employees to continue their work, affording the incident response team the focus to resolve the issue, while employees carry on without interruption.
• As interruptions to normal business are discovered, reporting and notifications for encountered errors will be automatically converted to tickets, available to the SOAR, with streamed events for further review by the incident response team.

Risk and recovery strategy

When covering the business objectives during natural disasters, the impacts extend beyond that of infrastructure and increase in the risk of human capital. Displaced employees and larger disasters could disrupt the day-to-day operations outside of the technology, though can be mitigated using advanced technology.

As the failover systems for data storage, networking, and power back up the real-time transition of the final information, switching and relaying to unaffected endpoints in different regions, the human component will be more difficult and riskier to resolve.

In the event of a disaster that impacts the capacity of employees on the job, virtual machines can be used to replicate employee systems, accessed remotely from safe locations. Through the maintenance of this plan, the core information technology backup image can be used to spin up virtual systems to replicate the onsite systems, allowing work to resume, as employees encounter safer remote spaces.

As a beverage company, physical assets such as production centers and warehouses offer important functionality to the business in producing and distributing the product. As the company plans for natural disasters, they should use the same strategy as they do for their technology servers, replicated production and warehousing that is not collocated. Having a distributed production and distribution network, allows for continuous operations and sales when one or more areas may be impacted, allowing the company to continue through inescapable downtime.

When cyber-attacks or natural disasters occur, influx of traffic or loss of data is mitigated by redundancy in the systems through distributed cloud data centers. These principles are commonly enabled through cloud platforms, allowing for direct to on premise server to connect to the cloud, creating interconnected redundancy.

In the cloud and software as a service (SaaS) era, technology enables the financial organization to continue many business processes digitally as they endure the disaster, even in a cyber-attack. The bigger threat to critical business systems falls outside of the financial and communication systems, which are maturely established in the cloud, behind is multi-zone redundancy.

Logistics, warehousing, and supply chain notifications will need to be handled in a physical redundancy pattern as described in the risk and impact analysis. Through distributed production and warehouses, the demand for product normally produced or shipped from the affected region can be reconciled from the other locations. Vendors will be notified and prioritized by demand, as different facilities will need to provide services to offset the offline distribution and production.

In the continuous process of system backup and recovery, on an hourly basis the sales and customer CRM is backed up, an offering available through SaaS, including the financial transactions and payment ledger. These are critical to the revenue generation of a financial organization and have been outsourced to simplify the compliance and guarantee real-time redundancy and hourly backups.

Product management software for logistics inventory and warehousing is backed up daily with continuous data center redundancy for enduring outages or loss of service. Communication systems such as phone calls and email servers, managed through a VoIP provider have the same redundancy and failover, with a weekly backup, storing records of interactions in real-time and converting them to storage-based blocks for archive.

Through all these business processes, the SaaS operation for phone and email have service level agreements (SLA) with guaranteed uptimes of 99.99%. In the software used by the company to sell, stored, process orders, and collect payments, they additionally have similar SLAs.

Employee systems, internal software, and secure product information is stored in the cloud, backed up each day, and recoverable through virtual machine images and database redundancy. The cloud service provider also offers an SLA to guarantee the uptime of their services at the same level as the SaaS providers.

All data is encrypted in flight and at rest, the prioritized data is the financial records, customer records, warehousing, and logistics information is prioritized. Employee desktops, generated documents, and desktop software settings are less important but are stored for the ability to replicate these environments in the cloud.

Roles and process

In the effort to retain disaster recovery and business continuity stakeholders from across the organization will need to be aligned to compose the incident response team. The level of involvement at the event horizon may vary based on role, though the planning of these events requires a core set of procedures in place before hand.

Business roles:

• Chief Executive Officer provides the top-level requirements of the plan and signs off on the requirements driven up from the organization.
• Chief Financial Officer outlines the financial coverage points that needs to be aligned for compliance and archived for business continuity.
• Chief Operating Officer designs the map of processes that need to be converted to automated technology and the requirements of redundant capabilities across the companies’ offices.
• Chief Sales Officer outlines the requirements that need to be redundant in communication technologies and inventory to stay revenue positive through a disaster.
• Chief Logistics Officer creates failover principles that can be used to recuperate inventory from distributed facilities in the event of an outage.

Technology roles:

• Chief Technology Officer designs the overall technical plan for the facilitation of the required technical services and collaborates with stakeholders to providers, enabling failover and redundancy.
• Chief Information Security Officer outlines the categorized data segments that need to be uniquely considered and archived following the plans of the CTO, enabling data security and resilience.
• Security Manager oversees the implementation and management of the response team and the service configuration designed by the CTO and CISO.
• Security Analysts review the requirements of the system design to understand the requirements and the ability of the design to meet compliance.
• Security Engineers implement the systems, cloud infrastructure, redundant features, and the automation behind the failover of services in the cloud.

In the event of a disaster through natural or cyber causes, the executive business team will provide the communication terms in which is shared to the external vendors of the financial organization to mitigate the surprise of supply chain impacts. As services deteriorate or encounter outage, system notifications will occur notify the user of potential impact, in certain circumstances, requiring additional verification for certain users.

As the initial response will focus on the general notification of the occurring events, inventory and order adjustments will occur overtime, these will be directly focused on a vendor-by-vendor basis as part of the replicated physical infrastructure’s ability to produce product.

These defined communication plans will be structured and templated to be maintained overtime as a method of staying relevant and in line with the most recent company policy. All these communications will need to be reviewed by the executive business team before being sent outside of the business.

The incident response team will handle coordinating the management of employee focused environments if needed and coordinate through the security manager to provide business service updates based around the maximum tolerable downtime (MTD). These resources will be mostly available on demand, although the documentation for accessing these as an employee will be provided in the latest format.

Disaster recovery, training, and auditing

In the spirit of readiness and chaos engineering, the financial organization will prioritize testing systems in lower environments, creating sequences of impact to one or more resource zones to test the time it takes for failover, data transfer, and backup to occur which will help assess the mean time to recovery.

Through load and stress testing the incident response team will measures the capacity of the cloud instances and SaaS services to understand the required compute to service the business at any one time. When knowing the compute size and the failover time, the ability to automate scaling and provisioning to support the down resources can be part of the structured plan.

The incident response team will perform a quarterly review of the required services, the compute, and the failover capacity. Through this lens the structural plan will be updated to keep a current understanding of the technology. Any new services added to the business will need to go through the same measures to complete a thoroughly planned profile.

As the response team composes the reports and works with the security manager to inform the executives, they will document and distributed quarterly reports and instructions to recover their employee services in the event of a disaster. These services can be complex and take time to provision, so a subset of the full system will be kept cold but online to be leverage for training and testing.

The security manager will work with the security and incident response team to test the controls of the system from a security posture and access angle. This security review will be an internal based audit to continuously check the effectiveness, scale, and reliability of the services.

As with the quarterly reporting, the security manager will inform the executive team on the latest requirements of network security plan. In the day-to-day security operation, the onboarding of endpoints, devices, and networks will reshape this plan and the stakeholder by in is required to account for the changes in the plan

Document management and continuous monitoring

The cloud file system offered to the employees will provide the additional desktop-based backup of information that supports the organization. These same services will create a baseline of continuity in document storage that supports all levels of the organization.

These documents used for disaster recovery and business continuity will be set as confidential and stored with access set only to the roles outlined in the above roles and responsibilities section.

Information and documentation around provisioning individual virtual machines during a disaster will be available on the intranet site accessible to financial organization employees. This information will document the process to accessing employee information remotely.

In a file storage perspective and intranet service capacity, all these services will be available through a SaaS provide that guarantees continuous uptime, redundancy and failover.

Through the SOAR based security system that covers the sustainability of the overall security posture, including events that require incident response, the intrusion detection system (IDS) and intrusion prevention system (IPS) will work in tandem with the firewall to capture ongoing logging. These interactive services will be capitalized for learning, improvement, and measurement on the effectiveness of established policies.

When enhancing and reporting for audit the capabilities of the monitoring and remediation systems, the security team will work with the security manager to enhance the systems security and its monitoring capabilities. These services will keep Stewart Distribution Co, in the adaptive tier of the National Institute of Standards and Technology (NIST) as it protects the security posture with continuous automation, in many ways, identifying, protecting, detecting, responding, and recovering through self-healing lifecycle capacities.

As this plan evolves, so will the system and the security considerations established in the overall security posture. These standards will enable the business to stay in an adaptive posture that can overcome and handle security and natural threats from around the globe.

Engineering resilience, security, and future-ready software architecture. Follow on X, GitHub, and LinkedIn, and visit https://joealongi.dev/.