New E-Commerce Risks

3. New E-Commerce Risks Closed Human Error/ Operations Risk Performance/Capacity Planned/Unplanned Downtime Outsourced Service Providers Security Incidents Content/Application Links to Third Parties

4. E-Commerce BC: New Rules/New Realities • IT and business process management are integrated — no longer solo views • Production costs increase — no separate budget for BCP • Risk identification and management take on a matrix management focus, e.g., technology, financial, trading, operations • Problems are public — IT and business problem management must be integrated; root cause analysis • Only as strong as your weakest link — good application/bad operations • Contingency plans become critical when automation isn’t there — every component of the business process now must have a plan

5. BC Components Disaster Recovery Business Recovery Business Resumption Contingency Planning Objective Mission-critical applications Mission- critical business processing (workspace) Business process workarounds External event Focus Site or component outage (external) Site outage (external) Application outage (internal) External behavior forcing change to internal Deliverable Disaster recovery plan Business recovery plan Alternate processing plan Business contingency plan Sample Event(s) Fire at the data center; critical server failure Electrical outage in the building Credit authorization system down Main supplier cannot ship due to its own problem Sample Solution Recovery site in a different location Recovery site in a different power grid Manual procedure 25% backup of vital products; backup supplier Crisis Management

6. Creating Business Continuity Plans Recovery Strategy PROCESS Ongoing Process Change Management Education Testing Review Testing Risk Reduction Implement Standby Facilities Group Plans and Procedures Project Create Planning Organization Risk Analysis Business Impact Analysis Policy Resources Scope Organization Business Continuity Planning Initiation

7. Obtaining Management Commitment BIA & Risk Assessment Catalysts Fiduciary Responsibility Awareness Programs

8. Security Incident Detection & Response Detection Incident Response Prevention/Planning Investigation Evidence Legal Action

9. Project Life Cycle Post Imple- ment System Architecture Business Req. System Design Implement Construct Test • Identify technology and business continuity risks from a business perspective – BIA/ risk analysis RTO/RPO • Ensure complete cost estimate • Ensure appropriately protected end product • Assess risks of new technology products • Identify secure infrastructure requirements • Identify secure administrative requirements • Establish security responsibilities and service- level regulations • Identify BC/DR strategies • Establish security test strategy • Translate security architecture to detailed security infrastructure design • Develop security baselines for new technologies/ products • Develop detailed security admin. design • Develop detailed BCP/DR design/ strategy • Develop draft SLAs • Develop security test plan • Build/code security infrastructure environment and processes • Build/code security admin. environment, roles/profiles and processes • Build BCP/DR environment, plans and processes • Build/code security test plan, processes, scripts and test environment • Train secure administrative, operations, business unit, staff... • Identify security noncompliance issues • Identify new security exposures • Test BCP/DR plans to ensure that RTO/RPO is attainable • Turn over secure application infrastructure to production • Implement secure administrative roles/profiles • Implement business/ continuity DR environment • Identify changes to tested env. • Finalize secure admin. env. and processes • Finalize security infrastructure environment and processes • Finalize BCP/DR env., plans and processes • Assess SLA accuracy • Finalize risk acceptance with business • Ensure that info. security policies are current

10. E-Commerce BC — Integrated Processes Risk Management (Financial, Technology, Operations) E-Biz Recovery Team Architecture and Standards OSPs/ Business Partners E-Biz Project Manager Application and Tech Design Business Manager Rules and tools Business Process Owner Risk Manager Recovery/continuity strategy/ design Business Continuity Business Continuity Mgr. Business continuity strategy/design Operations Architecture and Design Audit Security Incident identification/response design IT IT Recovery management Information Security IT Operations Problem, Change, Performance, DR Information Security Business Operations Legal/Compliance Audit — Financial and EDP HR / Public Relations

11. Problem Management Life Cycle Problem Prevention and Planning Problem Mgmt Team Problem Identification and Impact Assessment Business Process Owner Customer/Partner Relationship Owner Problem Resolution Problem Status/ Communication Risk Management Business Continuity Information Security Root Cause Analysis IT Technical Support IT Applications Support Vendors/OSPs/Third Parties Legal/Compliance Public Relations

12. Too Much Testing and Reporting Is Never Enough Management Reporting is Critical Location, Business Process or Department Accounts Payable Cash Mmgt. Order Fulfillment Accounts Receivable R&D Prod. Eng. BCP Phase Impact Analysis Risk Analysis Strategy Resources Committed Last Tested Change Mgmt. Last Major Review Workable Solution Audit

13. What Is Your Cost of Downtime? • Productivity • Number of employees impacted X hours out X burdened hourly rate Revenue • Direct loss • Compensatory payments • Lost future revenue • Billing losses • Investment losses Financial Performance Damaged Reputation • Revenue recognition • Cash flow • Lost discounts (A/P) • Payment guarantees • Credit rating • Stock price • Customers • Suppliers • Financial markets • Banks • Business partners • ... Know your downtime costs per hour, day, two days... Other Expenses Temporary employees, equipment rental, overtime costs, extra shipping costs, travel expenses...

14. Applying High Availability to Disaster Recovery Assumes mirroring or shadowing plusa complete application environment Hot Standby orLoad-Balanced Database and/or file and/or object replication Mirroring Log/journal transfer (continuous or periodic) Shadowing net $$$+ host $$$+ disk $$$$+ appl. $+ Cost Database and/or file and/or object backup Electronic Journaling Elec. Vaulting Standard Recovery net $$$+ host $$+ disk $$$$+ net $-$$+ host $$+ disk $$$$+ net $ host $ disk $ tape $ net $ tape $ 72 hours 48 hours 24 hours 12 hrs. Minutes Disaster Recovery Times

15. Designing E-Commerce Applications for No Single-Point-of-Failure Site Load Balancer Site Load Balancer Geographic Load Balancer Web Server Clusters Application Server Clusters Transaction Replication Database Clusters Database Clusters Database Replication Standby or Active

16. Data Replication for Continuous Availability Host-based Database Clusters Database Clusters Disk-based Replication Methods Examples Disk-to-Disk mirroring EMC SRDF, Compaq DRM, IBM PPRC and XRC, HDS HARC and HRC Log-based DBMS replication Quest Shareplex, Oracle Standby Database, ENET RRDF, SQL Server 2000 Server-based block or file replication Legato Octopus, NSI Doubletake, Veritas SRVM Application-based replication Typically implemented with message-queuing middleware

17. Emerging Technologies/Services • Capacity on demand/emergency back-up • Wide-area clusters • HP Continental Clusters • IBM Geographically Dispersed Parallel Sysplex • Cascading data replication Host Host Host Tape Backup/Archival High Bandwidth (fiber) Disks Disks Disks Operational Site Metropolitan/Regional Recovery Facility Primary Recovery Site

18. Disaster Recovery: Market Dynamics Load-Balanced (2+Sites) High- Availability- Based Service Warm Site and Mobile Recovery Warm Site and Mobile Recovery Quick Ship Quick Ship 2000 2004

19. Resource Internally or Externally Internal External (shared) External (dedicated) • You have an alternative facility (50 km distant) • BC vendors have insufficient capacity • BC is a recognized and respected discipline • You cannot economically benefit from syndication • You want to focus • on core competencies • Getting management sign-off for dedicated capital is difficult • Experience of supporting an invocation is important • Your planning scenarios include • loss of technical • staff • You do not have an alternate facility • You desire multisite continuous availability or hot standby support • RTOs/RPOs are very short

20. North AmericanBusiness Continuity Market Full-Service Providers • Comdisco Recovery Services and Web Availability Services • IBM Business Continuity Recovery Services and Outsourcing Services • SunGard Recovery Services and E-Sourcing Business Continuity and Internet Services • Professional services • Planning software • Hot/warm/cold standby • Mobile/static facilities • Mainframe/midrange/desktop • Quick ship • Peripherals • Networks • Work area • Specialized ancillary services such as check processing and data recovery What’s new — Full-service Web-hosting with BC “designed in,” multisite infrastructures for continuous availability, Web site and network “throttling” for performance

21. Negotiating a Favorable BC Contract — Balance Risk With Economies of Scale Cost Contract Terms Always use competitive tendering, even at renewal Include early-termination conditions Agree to a buy-out schedule Keep contracts to three years Unbundle contract costs Miscellaneous Understand upgrade costs Understand the right of access: “first come, first served” or shared Specify test time and additional fees Check syndication levels, risk exposures and exclusion zones Specify occupancy/comm. fees Touch the equipment. Visit the recovery center Declaration fees are negotiable For unsyndicated equipment, check cost of self-acquisition Annual cap fees