Security

Introduction In the first post of this series, I introduced the principle of Assume Breach and highlighted three areas that are often underdeveloped in practice: Business Continuity Planning, Data Loss Prevention and Cryptography. This post takes a closer look at the first of these topics: Business Continuity Planning, or BCP. In my experience when reviewing organisations through internal laudits, maturity assessments or ISO 27001 implementations, Business Continuity Planning is often present on paper. There may be a policy, a business impact analysis, a list of critical systems and perhaps even a recovery plan. However, the real question is not whether a BCP document exists. The real question is whether the organisation can continue to operate when disruption actually occurs. ...

Introduction In the past year, I have performed numerous internal audits. Across many of these audits, I observed a recurring pattern: three important security domains are often either limited in scope or insufficiently implemented: Business Continuity Planning Data Loss Prevention Cryptography In most cases, an initial effort has been made. However, the actual coverage, maturity and operational effectiveness of these implementations are often lacking. In my view, these controls do not always receive the level of attention and organisational weight they deserve. ...