WTGR

How much will it cost to develop a contingency plan, and increase our security where risk situations warrant?

compared to NOT doing this, and paying for the consequences if something does happen?

For some large scale projects overseas, it could cost millions of dollars to get the operation "up and running" after a disaster, which would also see the company fall behind other businesses that did have contingencies in place.

Or, a company could spend tens of thousands of dollars on security and contingencies so if a bad thing happens, the company can respond, and recover.

Or, a company can do nothing, and just hope that they are lucky, and nothing bad every happens.

Unfortunately, 
   o with terrorism reaching all corners of the globe
   o with corporate competitiveness resulting in some nasty competitor behaviour
   o with social-cultural/religious tensions boiling over in many countries
   o with weather extremes causing massive disruptions
it is very unlikely that you can just be lucky and not get hit

WTGR

"The risk analysis is the most complex part of a properly conducted disaster recovery plan. However, a clear understanding of the primary goal of a risk analysis, a grasp of the critical terminology, and adherence to a well-structured process renders this complex activity manageable."

The Goal of a Risk Analysis
"Disaster recovery planning seeks to provide a level of protection for corporate assets that will hopefully ensure a company's survival in the face of disastrous events. Before a protection strategy can be implemented, three basic questions must be answered."

   o What am I protecting?
   o What am I protecting against?
   o How much money, time, and effort should I expend?"

broken down

WTGR

Terms
Used

To better understand discussions on Risk and Threat Analysis, it is necessary that readers understand what is meant by some terms particular to this part of the security industry.

   o Asset: something worth something
           o it could be a human asset - a person you need to do something
           o it could be a facility, structure or building
           o it could be a piece of valuable equipment or a vehicle
           o it could be something related to communications and transportation
           o it could be data, such as detailed customer information
                 - basically anything of value that you want to protect

basically, the definition of an asset is something which is valuable for your company to have to carry out the critical aspects of business

Terms
Used

threats by themselves are not a problem, it is a problem when that threat is facilitated by a person "bringing it", or a situation causing the threat to go from "maybe" to "now"

Terms
Used

any weakness which, left unprotected, could cause the company to lose productivity 
or something that threatens asset value; 
for example, soil erosion from clear cutting a forest may create a potential flood if the typhoon is strong that year, which could flood a mining project that another company had nearby in the same region 

Terms
Used

In international business, an example of an exposure could the consequence of a particular currency rising very high, which wipes out the profit margin expected in an enterprise

Terms
Used

In the case of preventing against a flood, you could dig a large trench to divert flood water around the mine shaft so the drifts will not be flooded

In the case of preventing against political risk such as a violent change of government, you can hire a security force to repel looters and defend against small bands of soldiers that want to pillage your facilities

In the case of an I.T. failure, countermeasure could mean that corporate data is backed up at another location so if the main server fails, you have a back-up
Or countermeasures could mean that if you are hacked, you have the ability to not just know you are hacked, but actually do something to repell further attacks of the hacker, or even identify him to authorities

what are the 
specific
risks

MEDICAL

• medical trauma in remote areas and the subsequent evacuation and treatment
• Disease and plague
• in late Sept 2005 the WHO World Health Organization broadcast alarming predictions that a pandemic stemming from the bird flu virus (presently killing people in Asia) could kill as many as 150 million worldwide
• SARS 2003 could be considered an emergency that required carrying out Contingency Plans 

what are the 
specific
risks

VIOLENCE

• theft of expensive equipment and recovery of important corporate data; 
• kidnapping situations
• kidnapping for money
• kidnapping for political purposes
• violent robbery and assault of executives; 
• Mexico City, Moscow, South Africa, New York City, Detroit, L.A., Malvern !
• extortion and threats against company operations, offices and facilities; 
• security of communications and electronic countermeasures

what are the 
specific
risks

• municipal and regional government problems
• power blackout, accident or sabotage
• sewer flooding caused by heavy rains
• road closures, earthquakes, flooding, tornadoes

preventive measures

• Ensure that all at-risk personnel, and their support staff and team members, understand the action items they need to follow in contingency plans.
• meaning if the phones are out, you do this to communicate
• if the electrical power is out, you do this
• if there is extreme violence in the city, you go hide here
• Invest in access to international security consultants and treat their services as part of your core resources. 
• Incorporate security considerations into your initial plans. 
• Identify security resources within your existing staff, including medical and first aid knowledge, language abilities, logistical and transportation expertise and so on. 
• Develop security strategies with other Canadian companies operating in similar regions and situations of risk, including strategies for joint evacuation, medical assistance, terrorism incidents and perimeter security. 

preventive measures

Aaron C. was in MGTC44 he emailed Jan 29th, 2007 to make comments in response to what we had talked about in class with respect to Contingency Planning Aaron said..

WTGR wrote back to Aaron saying

I'll CC: my reply to the other C44ers cause your email makes a good point
- the big worry from government is
1. powerblackout caused by an ice storm,
2. or a sun spot surge, causing a power overloading and bringing on a blackout

-Because of government cutbacks in municipal infrastructure, it could be a week (or two) in some areas to get power back online
- and in a big city, it would take longer

My step-brother happens to be in charge of the physical-plant and generators for a large city hospital
- he says the generators can supply power, but

A. they can't run 24 hrs non-stop, they have to be shut down to cool the machine parts
B. they can only run as long as they have a fuel oil supply, and they only have a couple of days of fuel oil on the premises
C. by day 3 or 4 they'd have to get a truck to come in with more fuel ... BUT the truck can only make the delivery if it has gas and the gas pumps would all be shut down cause they run on electricity

- it has the potential to be a big big problem and something that Canadian businesses should think about

thanks again for your contribution Aaron