Information Systems and Infrastructure Interdependencies

1
Information Systems and Infrastructure
Interdependencies

• A Presentation For
• The Center for Research in Information Management
• November 8, 2002
• The Security Board, nfp

2
Agenda

• Defining the Business Problem - Interdependencies
• Security Boards Mission
• Major Initiatives
• 1) Infrastructure Interdependencies Exercise
  (IIE) (Simulation)
• 2) Regional Business Recovery Analysis
• 3) Regional Recovery Solution Development
• What we Need
• Benefits

3
Ground Zero . . . In Chicago? What would be
the effect?
4
The FinancialDistrict
1. OCC
2. CME
3. BOTCC
4. CBOT
5. CBOE
6. CSE
5
TransportationInfrastructure
7. UPRR
7
8. ATT Long Lines Center
8
11
9. BN/Amtrak
9
13
10. CMPO Chicago River
12
10
11. Purple, Green Orange Lines
12. Subway
13. LaSalle St. Station
6
Banking
21
7
15. Federal Reserve Bank
22
20
19
8
17
18
16. Bank of America
11
15
16
9
17. ABN-AMRO
13
12
18.LaSalle Bank
10
19. Northern Trust
20. Harris
21. ANB
22. Bank One
7
GovernmentServices
C
A
A. Daley Center
D
B
B. Dirksen Federal Building
C. Thompson Illinois Center D.
Chicago 911 Center Police - multiple Fire
multiple
8
MedicalServices
H
E. Cook County Hospital
F. University of Illinois Medical
Center
G
G. Rush-Presbyterian Medical Center H.
Northwestern Medical Center
E
F
9
Utilities
Multiple key stations For
Electric Telephone/ Communication Gas Water
10
The Problem

• Businesses havent created sufficient business
  continuity plans given the magnitude of current
  threats
• Industries havent created industry-wide business
  continuity plans for their members
• Companies havent taken a systemic view of
  problems created by supplier, customer and other
  interactions
• The problem of creating a survivable economy
  based on business continuity by the next
  transaction has not been addressed
• The cost for an individual company to implement
  more comprehensive continuity plans is daunting.
  A consortium of businesses and governmental
  agencies, working with the established vendors,
  enables a more workable strategy to be developed
  and implemented.

The more we know, the stronger we are
11
The Security Boards Mission

• The overall mission of the Security Board is to
  focus on and assist in ensuring that, in the
  event of an unanticipated interruption to
  corporate and governmental business operations,
  due to
• a terrorist,
• natural disaster or
• localized infrastructure interruption
• that critical business operations, most probably
  dependent on computers and telecommunications,
  can resume in a timely manner, supporting not
  only the individual organizations, but
  industry-wide and cross-industry relationships to
  ensure that national and local interests and
  security are safeguarded.

12
Security Board Involvement

• The Security Board has many supporters and
  participants. A few of these include

• SunGard
• PricewaterhouseCoopers
• ATT
• Argonne Labs
• Verisign
• Anixter
• TatumCIO
• Qwest
• Hitachi Data Systems
• Cisco

• University of Illinois
• Chicago City Colleges
• Illinois Homeland Security
• Chicago Transit Authority
• Illinois Commerce Commission
• Freeborn Peters
• IBM
• NASA
• Hewlett Packard
• Carlson Solutions

13
Major Initiatives

• 1) Infrastructure Interdependencies Exercise
  (IIE) (Simulation)
• 2) Regional Business Recoverability Analysis
  (RBRA)
• 3) Develop and Implement a Regional Recovery
  Solution

(Short term)
(Medium term)
(Long term)
14
1) Infrastructure Interdependencies Exercise
(IIE) (Simulation)

• The Security Board has the ability to deliver
  private organizations due to its association
  framework.
• The Security Board will organize an initial IIE
  (Simulation) for the Chicago area, focusing on
  the Financial Industry.
• An advisory committee will be developed from key
  business leaders to better articulate the needs
  of the business community.
• The Security Board will organize a number of
  future workshops based on the Boards objectives
  and the needs and desires of the business
  community.

15
1) Infrastructure Interdependencies Exercise
(IIE) (Simulation) (continued)
Each exercise will include

• A unique blend of leading business executives and
  government officials
• Presentation of a scenario, with dialogue
  regarding the problems we collectively face and
  discussion of potential solutions
• The exploration of the secondary and tertiary
  effects of a disaster event

16
2) Regional Business Recoverability Analysis

• Perform a high-level BIA over a region
• Based on the scope of the project (industry,
  region, etc), improved recovery requirements will
  be defined
• Possible solutions and costs will be explored
• Vendors will be identified to collaborate on the
  solution development
• A repeatable process will be defined and
  communicated to other regions

17
3) Develop and Implement Enhanced Regional
Recovery Solutions

• Work with Government, Vendors and Business to
  develop and implement enhanced regional recovery
  capabilities
• e.g. Dupage airport, Goose Island, other
  abandoned dot-com facilities
• Work with Government, Vendors and Business to
  implement event mitigation procedures (include
  Cybercrime and Physical Security preventative
  measures)

18
Next Steps

• Practical Feedback
• Support and Sponsorship
• Working to find additional Funding

19
Benefits

• Government is under pressure not only to act, but
  also to be accountable for the money being spent
  and to show tangible results.
• Our effort provides
• 1) accountability through the project office
  approach
• 2) direction to communities to determine
  priorities on where to spend money and,
• 3) tangible results that will help ensure the
  U.S. economy and our way of life are preserved.