Operations Security and Business continuity 1. Purpose The primary purpose for security operations practices is to safeguard information assets that reside in a system on a day-to-day basis, to identify and safeguard any vulnerability that might be present in the system, and to prevent any exploitation of threats. This is to ensure correct and secure operations of information processing facilities. Business continuity planning focuses on maintaining business operations with reduced or restricted infrastructure capabilities or resources. As long as the continuity of the organization’s ability to perform its mission-critical work tasks is maintained, BCP can be used to manage and restore the environment. If the continuity is broken, then business processes have stopped and the organization is in disaster mode (Stewart et al., 2004). “Make ‘Business Continuity’ ‘Business as Usual’ and imbed it into your management routines as decisions are made, instead of an afterthought check off the box exercise later.” – Bobbie Garrett – 2. Introduction The Security Operations domain is focused on identifying and protecting critical information within an organization. There are several core security operations concepts that any organization needs to implement to provide basic security protection. Resource protection ensures that media and other assets that are valuable to an organization are protected throughout the lifetime of the resource. Patch and vulnerability management controls ensure that systems are kept up-to-date and protected against known vulnerabilities. Configuration management helps ensure that systems are configured similarly, and change management protects against outages from unauthorized changes. Security audits of these controls provide assurances that the controls are in place and providing the desired protections. Whereas, Business continuity planning involves assessing the risks to organizational processes and creating policies, plans, and procedures to minimize the impact those risks might have on the organization if they were to occur. Business continuity planning is used to maintain the continuous operation of a business in the event of an emergency situation. Lebanese National Security Policy Guidelines v1.7 Page 43 |