B.C.C MANAGEMENT IS PARTICIPATING IN THE WORLD BUSINESS CONTINUITY AWARENESS WEEK.

Join us and book your place now for the webcast “ IT DISASTER RECOVERY IN THE BUSINESS CONTINUITY MANAGEMENT”

Click to read an introduction to BCAW

Business Continuity Awareness Week (BCAW) is the global educational event designed to help people understand more about business continuity management, its applications and benefits.

BCAW is facilitated by the Business Continuity Institute (BCI), the prestigious international membership body for business continuity management with over 5,000 members in 90 countries.

Join us along leading industry professional, ( Deloitte, Oracle, British standard institute BSI, EBAY,  and many others)

http://www.bcaw2011.com

http://www.bccmanagement.com

Join us and book your place now for the webcast “ It wasn’t raining when Noah built the Ark!. Have a plan, be prepared!! “

For Circulation

Join the cause and support Rima Khalife who will be participating in Marathon of Team in Training Canada which is the charity training program for The Leukemia and Lymphoma Society.

The Leukemia and Lymphoma Society (LLS) is the world’s largest voluntary health organization. It is dedicated to raise money to help fundraising blood cancer research and providing education and patient services. They have invested more than $600 million in research since 1949 – over 71$ million in 2008- specifically targeting leukemia, lymphoma, and myeloma. Moreover, 370,000$ were invested in Quebec.

WHY DID SHE DECIDE TO PARTICIPATE IN THIS EVENT?
As a survivor of cancer herself, she have decided to go on with this unique half-marathon in honour of three great friends who were recently diagnosed (at the same time) with a different kind of blood cancer. Due to advance research and treatments, these people are in remission and they are continuing with their life normally. However, the situation would have not been the same many years ago.
So she I decide to try and make a difference in these lives and the lives of many other people with blood cancer by participating in this upcoming event; for a GOOD CAUSE.

BCCManagement would like to thank her for the time she spent with our institution showing a positive personality when everything was down for her and would like to wish her health, love and success.

Please support her by donating to the cause

To donate or for more information and to stay update on her raising program, please visit her webpage frequently.
http://my.e2rm.com/personalPage.aspx?SID=2465983
Thank you in advance.

BCCManagement

The donation was given to the Canadian Red Cross.

Over $2 billion dollars have been raised in the last month for Haiti relief. The work will take years and organizations in Haiti continue to need funding. If you haven’t contributed in a few weeks, please consider making another donation through one of the groups below.

Support the Canadian Red Cross in Haiti earthquake relief efforts. Your support would allow them to send urgent needed aid, support and most importantly hope to Haiti.

Your generosity will allow the Red Cross to:
• Send over 2,600 metric tons of relief items to Haiti
• Distribute 1 million liters of water to 200,000 people each day.
• Provide medical care to over 9,600 people so far, including urgently needed psychosocial support.
• Provide relief items such as blankets, kitchen tools, tarps, jerry cans and hygiene items to over 122,000 people.

A look to the future
the earthquake has affected approximately 3 million people. Your support will allow the Red Cross to provide urgent needed help, and will ensure that the Canadian Red Cross is there for the people of Haiti in the challenging months and years ahead. An in-depth analysis of the long-term needs of Haiti is currently being conducted by the Red Cross to determine how to rebuild the nation and make it stronger, healthier and more resilient.

https://secure.e2rm.com/registrant/donate.aspx?EventID=43149&LangPref=en-CA

A month after the tragedy Haiti from tragedy to opportunity

THE CANADIAN RED CROSS RESPONSE
When the earthquake struck on January 12, the Canadian Red Cross already had workers on the ground in Port-au-Prince. Miriam Castaneda, the CRC’s Haiti program manager, immediately began coordinating and providing relief to those in need, and opened the CRC’s Port-au-Prince office to more than 200 survivors.
Here are some other highlights of Canadian Red Cross activities in Haiti:
• 38 Canadian delegates have been deployed in Haiti, working in health, water and sanitation, shelter, assessment and communications.
• A joint Canadian/Norwegian field hospital (along with CRC delegates) was deployed within days of the quake and is set up adjacent to the University Hospital in Port-au-Prince. It can provide essential surgical and medical care for up to 300 people a day, with a 70-bed ward; customized modules for surgery, first aid and triage; a community health unit; and a psychosocial support unit. This ERU was funded in part by the Canadian International Development Agency (CIDA).
• More than $400,000 worth of Canadian Red Cross pre-positioned stock from Panama has been deployed to Haiti, including tents, blankets, buckets, jerry cans, tarps and mosquito nets.
• At a Red Cross Red Crescent summit held in Montreal, it was announced that Canadian Marcel Fortier will lead the IFRC’s Haitian delegation. Fortier has nearly 30 years of experience with the Red Cross Red Crescent, working in 10 countries in the areas of disaster response, program development and resource mobilization.

THE COMING MONTHS
Over the past month, the focus in Haiti has been on emergency relief—medical care, clean water and the distribution of basic relief items.
But another crisis looms: Haiti is about to enter the rainy season, which brings with it strong winds and up to five centimeters of rain each day. And it’s followed by the Caribbean hurricane season. That makes providing waterproof shelter the top priority. At the request of the UN humanitarian relief coordinator for Haiti, the IFRC is spearheading the effort to provide shelter to those who need it. To date, Red Cross Red Crescent workers have handed out shelter materials to some 95,000 people, including tarps, tools and nearly 1,000 tents. But there are still 1.2 million Haitians in need of housing—and very little land on which to settle them.
The spread of disease is also a growing concern, with solid waste piling up in camps, and hundreds of thousands of people living without adequate shelter, food or water. The Red Cross Red Crescent movement is delivering up to 1.3 million liters of clean water each day and digging latrines at 12 camps. But it’s still not enough.

GOING FORWARD

Haiti faces a long and difficult road ahead. It was already the poorest country in the Western hemisphere. Now, hundreds of thousands are left without homes or livelihoods. The Red Cross Red Crescent movement is committed to helping Haiti throughout its recovery, reconstruction and development phases, building a stronger, healthier and more resilient community. This includes building back the operational capacity of the Haitian Red Cross; the reconstruction of buildings, livelihoods and communities; and wide-scale investment in disaster risk reduction.

To see photos of your support in action, please visit the Canadian Red Cross Flickr page at

http://www.flickr.com/photos/canadian_redcross/

info@BCCManagement.com
North American Office +1.800.961.7592
Fax: +1.613.248.5149
P.O.Box 42054- RPO ST Laurent
Ottawa ON K1k4L8 Canada North American Office Head Office
Phone: +1.800.961.7592
Fax: +1.613.248.5149
Toronto ON M2R1X9 Canada Middle East Office
+961.7061.9274
Fax: +961.923.2406
P.O.Box 116-5108
Beirut Lebanon

Feature at Business continuity Journal, continuity central, survival guide, scribd ….

www.BCCManagement.com
Email: info@bccmanagement.com

This study is to stress on the correlation between the War and the Business Continuity (BC), especially for the Medium-Large Enterprises. Therefore, a true case of a recent war had been taken to emphasize and analyze the necessity of integrating and ADDING WAR TO BUSINESS CONTINUITY PLANNING.
Background

War actualities in Lebanon

 Destruction of National and local Airports (3)
 Bombarding all national seaports (7)
 Tightening air, sea and land blockade
 Targeting high-voltage electricity lines
 Hitting power stations (5) and electrical transformer
 Setting fire to fuel depots
 Bombing petrol stocks
 Blasting more then 40 petrol stations
 Devastating wide swathes of infrastructure  Bombing major and minor bridges (107)  Blasting main roads and highways (445,000 m2)  Denying access to many villages
 Total destruction of cities and villages
Private houses/ Apartments
Total destruction:30 000 Major :30 000 Minor:70 000
 Destruction of Hospitals (2), Health care centers (50)
 Total destructions of 60 schools and another 100
…schools suffered minor hits
 Hitting mobile / wireless relays
 Blowing up audio visual relays
 Evacuation of more then 200 000 people
 Most of foreigner workers fled
 Separation of families and children
 Bombing more then 600 trucks
 Curtailing movement and bombing of medical supplies and ambulances
 Sewage Disposal Systems and Sewage Treatment plants bombarded
 Bombardment of more then 40 factories
 Main / secondary water distribution 330 stations
 UN Resolution 1701 Ending 33 days of war

Aftermath of war in Lebanon

 Closure of all landing fields
 Obligating MEA Airline to relocate their airplanes to another country
 Shutting down all sea shipment accesses
 Debilitating the import and export activities  Failure of abroad mailing system
 Blackout of electricity to half of the country
 Impossibility of providing fuel ships for supply
 Capacity reduction of oil and petrol reserves
 Sea Oil Spillage
 Beirut Stock Exchange plunges 15% and closed for 25 days
 Lebanese pound has shaken by 1%
 10 billion Business/financial loss
 Most of the Factories, organizations, and offices closed for one month and other failed to open or to return to Lebanon
 1.4 million tourists loss
 Cancellation of hotel bookings
 Cancellation of many summer festival
 Lessening the medical supplies and drugs
 Aid could not reach the needed people due to blockades
 Relocation of 800,000 citizens to other areas (27% of Lebanese population and more)
 Environmental degradation of the aquatic speeches due to oil spills and air pollution from bombarding and bombs and forest being burned ( biodiversity)
 Contamination of Water
 Decreasing Potable Water
 Spread of Diseases/sickness
 Human Losses 1,191 and another 50 from clustered bombs and 4,405 injured

Business Preparedness

How and why should an enterprise integrate war in its Business Continuity Planning?

Since September 11, 2001 business continuity gained high interest, but still are we ready today? Not really, but at least, we are on the road.
While attending the “16th World Conference on Disaster Management” in Canada – June 2006, it was impossible not to notice the poor participation of countries in the conference, for instance there were 1700 delegates from 47 countries only. In other terms, 1700 is a promising figure as far as individual participants but 47 is a very shy number for countries representation.
Where are the rest of the countries not only from that conference but from BUSINESS CONTINUITY?

Some traditional business continuity risks and threats might not be good in war situation.

Working with several Medium-Large Enterprises after and during the war in Lebanon, supplemented a lot of data to this case study.

EFFECTS OF WAR

First question to ask in a war situation: “ do you still want to operate from within the effected country?”

According to ABC news
“We are looking at how we might transport
Americans to Cyprus. Once in Cyprus,
Americans can then board commercial aircraft
for onward travel,” an embassy statement said. “

a) Evacuation:

• Do your organizations/governments have plans for mass evacuation?
• Do governments have plans to receive high number of people, from neighboring countries in case of war?

BEIRUT, Lebanon Jul 15, 2006 (AP), The
United States is working on a plan to evacuate American citizens from Lebanon to the neighboring island of Cyprus, the U.S.
Embassy said Saturday.

For instance, Cyprus called the European Union’s aid in the situation, since it could not handle the load of evacuators.
Reading the ABC articles (on the right side), it is obvious no plans were available and forecasted ahead for such an emergency. In addition, taking the USA as one of the biggest countries, it took long time to come up with a plan and to evacuate all of its citizens from the Lebanese territories. Evacuation took more than 18 days.

Evacuation of foreigners residing in Lebanon:
- Sri Lanka; 90000
- Canada; 40 000
- Philippines; 30 000
- United States; 25 000
- French; 25 000
- UK; 25 000
- Australia; 25 000
- Indians; 12 000
- And many more others….

a) Relocation:

Due to the war, many foreign and affiliated organizations relocated their headquarters and businesses from Lebanon to neighboring countries carrying on their work but unfortunately they never returned back.

b) Electricity:
Due to the air and sea blockade and bombardment of power stations and electrical transformers, the electricity blackout happened in two phases.

- First phase: A direct result from the bombardment of power stations and fuel reserves.
- Second phase: An indirect result from the lack of petrol and fuel feeding the un-bombed power stations.
Since the beginning of the war, the electricity crisis started, providing only 18 hours per day until reaching down zero hours per day for the highly affected areas due to lack of refueling.
As mentioned previously, the blockade led to a shortage in the oil / petrol country’s storage as well as the direct bombardments of petrol stations reduced the chances of having enough quantities for distribution.
In front of these facts, the citizens and the companies panicked and bought petrol tanks for stockpiling, noting that at that stage, the prices were increasing tremendously.

i) Mail /Post services/Courier:
Another outcome of the blockade was the complete paralysis of the mailing system (air, sea and land) as well as the internal post services.

Consequently, all the parcels and courier mails were extremely delayed if not lost. However, during the war, and a later stage, some courier companies offered their services but with a noticeable growth of prices (10-20% increase) due to the risk available in transporting the parcels from / to Lebanon internationally.

j) Mobile/Wireless/Radios/TVs:
In Lebanon, Radio and TVs antennas are mostly located adjacent to Wireless and Mobiles antennas.
During the war, most of the biggest Radio and TV antennas were targets for destruction due to political reasons. Consequently, the nearby wireless and mobiles antennas were seriously damaged cutting the telecommunication among regions in the country.
Worth mentioning, that due to the disorganization of the electricity, the wireless relays started to shutdown respectively noting that UPS can hold only for few hours.
l) Monetary & Stock Market
In Lebanon, the currencies dealt with are both the Lebanese Pound and the US Dollars.

The Central Bank of Lebanon, on the 3rd Day of the war, issued a memo stopping all USD cash transactions due to the worry on the Lebanese Pound to fall, and because people started drawing large amounts of cash in USD due to panic.
The transactions from Lebanese Pound to Dollars were allowed but not as far as cash, so that no panic will occur and to protect the Lebanese Pound.

A small increase of less then one percent was noticed in the foreign exchange.

• Stocks went down on the 2nd Day by 10 % and then the Stock Market closed on the 4th Day no transactions were accomplished due to many technical, non-technical reasons and due to the high demand on selling.
• The Stock Market closed for more then three weeks consequently financial losses were very high.
• A high amount of selling took place once the stocks were trading again.

ANALYSIS
Several considerations should be incorporated in the Medium – Large Enterprise’s strategies and plans in order to better handle a war situation. The following parts will go over the key points and considerations advised and necessitated for integration in the Business Continuity Planning.

Medium – Large Enterprise’s Considerations:
Army/ Safety: 1- Determine which employees accomplished the military service and identify who might be called in the future. In addition, the company should be aware if a key job post in the BCP was given to an army reservist in order to train ahead a stand-in staff.
2- Make available a shelter not just an underground parking since nowadays this latter will not block the new bombs (reaching more then 200 feet).
Petrol / Fuel: 1- Extra fuel storage for the generator is necessary for the Data Center or DR site since in war time no re-fueling will be available and maybe for a long period.
2- Purchase some motorcycles in order to use them when needed for easing transportation or delivery, due to the very low utilization of petrol.
3- For the Large Companies think of the possibilities of purchasing a petrol station for emergency purposes since it will be handy in case of war.
Media:
The employees especially the executives should be trained on statements in the name of the company, especially in case of an unpleasant incident. They should be taught on the content and extent of the information allowable to be provided as well as the timing.
Radio/TV: Even though it is a cost saving strategy, installing Radio & TV Antennas adjacent to the Mobile and Wireless Antennas is not a very wise step since risks are higher.
Mail /Post services/Courier: Does the business rely on mail and parcels? If yes, the company’s SLA should be checked. Even if there is an SLA of services given to companies, attention should be based on the human factor, for instance plans for services degradation should be made.
Internet: 1- Plan for a backup solution for the provision of internet. For instance, the company should find out from the ISP their BC plans.
2- Foreseen backup plans in case ISP failed to provide their services (ex: bombarded).
3- Make special arrangements if the fiber optics in the sea or land were destroyed. 4- Arrange for a satellite communication providing internet services.

Evacuation: Putting the facts of evacuation into business how can you replace 1000 foreign employees that evacuated, and most of these employees hold important positions in the company and without them the business cannot survive.

Information technology:

Questions: Do you do backup? Do you send tapes to another site?
If yes; for how long do you retain them and do you test them monthly?
Do you know what are you backing up? Can you replace your key staff without stopping business? If you answer no to any of these questions, then you have drastically failed to provide the safety, security procedures and the minimal business continuity for the company.

1-Choice of the location of the recovery center should be away from the datacenter, a further option could be to establish the recovery center in another country in case the company possesses an overseas branch.
2-Set procedures identifying “how, why and who” can fix each type of failures from the vendors. This requires checking out the SLA agreements with the vendors.
3-Stockpile spare parts – as much as it is affordable -in the recovery center in order to be used either in the main Data Center or in DR site.
4-Having seen recovery centers, unprotected, on some high floors of a shared building, in a busy neighborhood, very close by petrol tanks all of these are high risk factors.
5- Updated Configuration Manuals are essential in the recovery center (routers, firewalls etc…)
6- Think in satellites and make it part of your monthly testing procedures, satellites comes to the game when everything else fails, satellite phones, satellite WAN, satellite internet, etc… if you offer international service your clients in china should not be affected if you have a problem in the Head Quarters.
7- Make sure to install voltage regulators in order to avoid the failure of the hard disks and other parts due to the low/high voltage of electricity especially during war when electricity is not well controlled.
8-One organization plans covered the bad days and not the good days.
Three days after the war when people were resting, the department that is responsible for the cooling of the datacenter room got a call on high heat, and he didn’t answer to the call and the worst had happened 34 days of war and the organization had survived, suddenly out of nothing the cooling system got jammed to an unknown reasons and the heat hit 55 degrees Celsius, you could fry an egg on the steel, so some systems had heat protection and shutdown by them selves others were damaged due to heat.
Plan for HVAC and automated monitoring systems.
9-Another organization had to change the uninterruptible power supply UPS during the war after a defect has been noticed.
After trying many times to reach the company but no luck due to some bombarded networks and network coverage then the manager had to be contacted and leave the call with him to manage the replacement, the problem was, that all of the company employees were in an effected area of wireless coverage they couldn’t be reached and once reached couldn’t reach the site, but in the end the ups was changed.

10- Interference: Due to Navy ships that were near the cost line, they interfered with most of telecomm and wireless transmission which forced businesses to loose communication with each other, plans should be made to include this and also governments should plan about it, on where to park the ships to minimize the risks
11- EMP Electro Magnetic Protection. With today’s arms technology, the need of a protected anti EMP environment is a must.

Insurance: Almost all the companies are insured. But what about war and terrorism, nobody is insured against those so think of what can be done
Contact System: 1- Set up an emergency phone line for giving and taking instructions to/from key staff in BCP using a system similar to a voice machine-giving guide of required procedures.
2- Test the Call Tree several times per year. In case of a disaster or a war, problems in telecommunication with the staff might be faced; this is where the emergency phone line could play a role. A special satellite notification system could be used as well.
3- Work on a notification system. For instance, one phone call and the system will contact ever person included on the list through several ways (email, sms, telephone, website, emergency phone line, pagers, etc …).
4- Have CBs ready and charged in the recovery center with extra batteries and charging modules.
Vendors Related: While entering into business agreements with the vendors, the companies
should take into consideration several issues / questions among which:
• Do vendors have BCP? Does it cover internal and external services? • If they have a BCP; what is their service level agreement?
• Do they have a dedicated team focused on BCP and disaster recovery? • Do they have a crisis management process?
• Will they provide support in case of war and terrorist attack? • What is the timeframe to provide their support?
• When last did they test the plan?
• Will the backup spare parts be available in another site at their locations?
• Will they provide primary and backup contact information during a disaster?

Thoughts crucial for the selection of Locations for Data and Recovery Center:
1- War and its effects should be taken into consideration
2- Option of establishing a secondary recovery center should be taken.
3- Ask the question: Should the recovery center of the organization be in 100 miles radius of the main datacenter or more?
4- Try to have the petrol tanks stored below ground and far from the recovery center, in case it blew up.
5- Try to plan for recovery center outside the main country of operations

8

6- Plan for the isolation of the data center/DR site in case of occurrence of a chemical/biological war.

A Number of Advises for the Organizations/Employers:
1- Don’t expect employees to show up for work during the war, find out who has a strong
character or personality and can bare the danger fear, because if you gave a key personnel in
the team responsibilities, and he got scared to do the job, that will be another disaster.
2- Try to help employees, in case of lack of petrol may be through supplying them with petrol to
show up to work, or providing a small transportation system (a mini bus) to pick them up.
3- Understand the employees and be aware that they will not come to work and their families are
in danger, seek to bring their families to work, have a place at the organization ready to
welcome people i.e.: beds, food, water, etc…. or at a near by hotel.
4- Have a therapist to aid your employees at all time, during and after the war as well as in good times.
5- Reduce the time schedule of work i.e. during peace days if the work schedule is from 8 am to 4 pm adjust it from 8 am to 1 pm or whatever is convenient.
6- Pay early salaries or an extra half salary without taxes since people will be needing money.
7- Avoid employees’ rotation during the war, since it will be a burden and time consuming.

References:

• www.cnn.com
• www.reuters.com
• www.albalaonline.com
• www.pcm.gov.lb
• www.state.gov
• www.turkishdailynews.com.tr
• www.aidlebanon.org
• www.bbc.co.uk
• www.canada.com
• www.reliefweb.int
• www.abc.net.au
• www.dw-world.de
• www.sr.se
• www.ameinfo.com
• www.moroccotimes.com
• www.csmonitor.com
• www.cbs5.com
• www.gartner.com
• www.lebanonundersiege.com
• www.undp.org
• www.annaharonline.com
• www.tayyar.org
• www.rawstory.com
• www.sweden.gov.se
• www.aljazeera.com
• www.khaleejtimes.com
• www.haaretz.com
• www.latimes.com
• www.guardian.co.uk
• www.christianaid.org.uk
• www.english.people.com.cn
• www.sabcnews.com
• www.yahoo.com
• www.time.com
• www.news.infoshop.org
• High Relief commission
• Local New papers
• And many more…

After successful payment, your information will be filled out towards the CBCI Application. This form requires basic demographic information, details about prior work history in Business Continuity Management, and the provision of 2 referees. A current resume is also required to submit the application.
Once submitted, an Education Consultant will contact you within 4 working days, usually sooner, to provide you an authorization to test letter, which will include a link for you to choose a venue date and time.

The examination (English language) consists of 120 multiple choice questions which the candidate will have 2 hours to complete.

What happens after the examination?

At the end of examination all candidates should receive an immediate confirmation notice that their answers have been submitted by for marking. This confirmation will show where results will be sent – please check this for accuracy.

Results should be available within 4 to 6 weeks after the examination and will be mailed to the address shown on the confirmation notice. Under no circumstances will scores or pass/fail information be released over the phone.

Email support@bccmanagement.com to help you book your exam.

OTTAWA OPERATION CENTER OC

MAILING ADDRESS
P.O BOX 42054
RPO ST LAURENT
OTTAWA, ON, K1K 4L8
CANADA

Tel: +1.800.961.7592
Fax: +1.613.248.5149
TORONTO HEAD OFFICE HO
4915 BATHURST STREET, UNIT # 209-338
TORONTO, ON, M2R 1X9
CANADA
Tel: +1.800.961.7592

Middle East Regional Office

P.O.Box 116-5108
Beirut -Lebanon
Tel: +961.7061.9274
Fax: +961.923.2406
ttp://lebanon.bccmanagement.com

Technology is an important part, but only a part of a comprehensive information security solution. Equally important is the development of an information security policy for your company, an assessment of your current situation, and training for all users and process owners.
Securing the internal network is as important as securing the external network (ex-employees, contractors, temporary personnel, fired employees, Viruses …)
Also never think that Security incidents won’t happen in your organization, no matter how big or small you are, because it does and once it hits it hits hard.

It is a must that the technical implementation is actually drafted from a policy not just on the ground only.

Security is part of an organization internal process never to be outsourced, Technical capabilities can be found outside but the process should be owned by the organization only.
Below are some 20 steps to consider for securing your Information Technology, Microsoft Windows Business environment:

 One man do it all should not exist in your organization, small or big since it is a serious threat.
One man show was a phenomenon and is becoming more since the economy recession and this may lead to the organizations depending on one single person to do the Security/IT administration job and the High potential risk of losing him and its consequence on the job and security aspect. (Retirement, Firing, Resignation or Sudden Death)

 Lock down your workstations and Network
Don’t Allow End Users and Administrators to Log On as Administrator
Create an alternative account non administrator for administrators, to do the daily work and when admin privileges is needed use the RunAs Feature, the application will run in administrator account privileges.

 Disable Booting from CD, USB and everything else but the Primary Hard Disk, and put a password on the Bios.
With that in place no change can be done, or any trials of booting from alternative.

 Rename the Administrator and Other Highly Privileged accounts, first thing a virus tries is to get admin privileges using the administrator account and trying passwords and if it is renamed with a strong password then it is 100 % Safe

 Defeat Password Crackers Enable password complexity in your environment no matter what.
And enabled password lockout (be careful Viruses e.g.: Conficker.C) Disable LM hashing. And enable NTLM version 2 and run (LC 4 to test Cracking SAM)

 Strengthen Windows Services.
Disable un-necessary service e.g. telephony or schedules.
Define the log on as a services accounts as a GPO.
Change Standard ports for Example SQL Server.

 Work on NTFS permission for users files and important executable
And be careful on the registry it is an important part of security which you must secure, Firstly if it is possible to stop remote registry access, and always deny non admin user to have write on it.

 Run Firewall, antivirus, spyware on local Workstation and on networks for example internet/email gateway (in case the antivirus on the Workstation is outdated or disabled) have different brands make sure you antivirus can’t be disabled or killed.
Separate the external network from the internal, using DMZ; never Ever publish any service directly to internet from the internal network.

 Patch, Patch and Patch
Nothing more important as patching as an organization you need a patch management solution, there is plenty in the market for Example Windows SUS which comes for free.
Others such as SMS, GFI, Shavlik.

 Get a remote access solution, in case there is a need for it or in case a disaster hit and no accessibility to the premises.

 Get and Have an effective backup/Restore solution, Test Backups Frequently, and don’t forget to integrate it to the policy.

 Disable FTP access to the outside world.

 Invest in your network:
Get network firewalls (from layer 1 to layers 7 today’s viruses are on all layers) for VPN/IPSec Tunnels and segregation of network (VLANS)
Get web and email filters but an intrusion prevention system.
And not forgetting someone dedicated to look at the logs otherwise all the investment is thrown away
Also encrypt tunnels or data if you have more than one branch, never send clear data and never presume it is safe.

 Lock, Log and protect the IT Server Room/Data Centre (theft, Fire, breaking, leakage)

 Clustering Alone is not enough using Data replication where adequate also. Since Clustering only protects application failure not data.

 Do periodic external checks using Nesuss or any other product just to see if you are exposed to the outside world.

 Be careful of SNMP Components to change the password never leave them to defaults since a virus/technical person can issue command to shut them down or unauthorized access to the components can happen, which may lead to undesirable events.

 Have all your employees acknowledge formally the IT/Security Policies and procedures.

 Wireless:
Be careful from wireless Networks if they are configured wrongly.
Always have them behind a firewall; always use high encryption and never use static password connect them to a Radius server or any other password mechanism for ultimate security.

About BCCManagement:
We’ve been in Business since 2006, we have participated in several related International Conferences and seminars held in many countries including Canada, United Kingdom, and the United States.

Also, we published numerous Business Continuity studies and articles in renowned magazines and international websites, noting that BCCManagement had been actively involved in the development of standards dealing with Business Continuity namely the Business Continuity Standard BS25999.

In 2009 BCCManagement has done a corporate partnership with Business Continuity Institute BCI to Bring It’s Client the state of the art Business Continuity practice.

BCC Management Canada – Lebanon, Is proud to present Business Continuity Training in Lebanon on October 5-6 2009 in Radisson Hotel – Beirut Lebanon.

Recommended Participants:
::: Business Continuity Managers
::: MIS / I.T Managers
::: Project Managers
::: Head of Operations
::: Audit Professionals
::: Internal and External Auditors
::: Financial Controllers
::: Risk Manager
::: IT Security Manager

Objectives:
The Objective of this course is to facilitate the
participants to understand the Business
Continuity concept.

The Course Content will cover 5 major processes
as endorsed by the Business Continuity Institute BCI.

::: Understand your business
::: BCM Strategies
::: Developing a BCM Response
::: Developing a BCM Culture
::: Exercising, Maintenance & audit
::: Understanding compliance requirement regarding Basel ii, BDL.
ISO 27002 and BS 25999

Outcome of the Course:
::: Understanding of the different standards
(BS 25999 and ISO 27002)
::: Understand how BCM works towards your organization
::: Understand the Benefit of Business Continuity Management
::: Understanding how to be an accredited certication

Material Provided:
::: Workshop Manual
::: Support documents & Solutions for exercises (ON CD)
::: Course certificate
::: BCM Case Studies (ON CD)

Registration:
Price: 530 USD
Includes:
::: Lunch
::: Free Internet Available

To Download the registration form :
lebanon.bccmanagement.com/ or
lebanon.bccmanagement.com/registration.doc
Email it to info@bccmanagement.com
Or Fax it to +961.9.232406

http://www.facebook.com/event.php?eid=160537960405&ref=mf

http://events.linkedin.com/Business-Continuity-Training-LEBANON/pub/120404

About BCCManagement:
We’ve been in Business since 2006, we have participated in several related International Conferences
and seminars held in many countries including Canada, United Kingdom, and the United States.
Also, we published numerous Business Continuity studies and articles in renowned magazines and international
websites, noting that BCCManagement had been actively involved in the development of standards dealing with Business Continuity namely the Business Continuity Standard BS25999.
In 2009 BCCManagement has done a corporate partnership with Business Continuity Institute BCI to Bring It’s Client the state of the art Business Continuity practice.

Outline of the Standard
After the introductory sections, the standard contains the following twelve main sections:
1. Risk assessment
2. Security policy – management direction
3. Organization of information security – governance of information security
4. Asset management – inventory and classification of information assets
5. Human resources security – security aspects for employees joining, moving and leaving an organization
6. Physical and environmental security – protection of the computer facilities
7. Communications and operations management – management of technical security controls in systems and networks
8. Access control – restriction of access rights to networks, systems, applications, functions and data
9. Information systems acquisition, development and maintenance – building security into applications
10. Information security incident management – anticipating and responding appropriately to information security breaches
11. Business continuity management – protecting, maintaining and recovering business-critical processes and systems
12. Compliance – ensuring conformance with information security policies, standards, laws and regulations
Within each section, information security controls and their objectives are specified and outlined. The information security controls are generally regarded as best practice means of achieving those objectives. For each of the controls, implementation guidance is provided. Specific controls are not mandated since:
1. Each organization is expected to undertake a structured information security risk assessment process to determine its specific requirements before selecting controls that are appropriate to its particular circumstances. The introduction section outlines a risk assessment process although there are more specific standards covering this area such as ISO/IEC 27005.
2. It is practically impossible to list all conceivable controls in a general purpose standard. Industry-specific implementation guidelines for ISO/IEC 27001 and ’27002 are anticipated to give advice tailored to organizations in the telecomms, financial services, healthcare and other industries.

The control objectives and controls in ISO/IEC 27002:2005 are intended to be implemented to meet the requirements identified by a risk assessment. ISO/IEC 27002:2005 is intended as a common basis and practical guideline for developing organizational security standards and effective security management practices, and to help build confidence in inter-organizational activities.

References:
Wikipedia.org
iso.org

About BCCManagement:
We have been in Business since 2006 we have participated in several related International Conferences and seminars held in many countries including Canada, United Kingdom, and the United States. Also, we published numerous Business Continuity studies and articles in renowned magazines and international websites, noting that BCCManagement had been actively involved in the development of standards dealing with Business Continuity namely the Business Continuity Standard BS25999.
BCCManagement Professional team is proudly certified by the “Business Continuity Institute (BCI) England” which is the major international players in Business Continuity field.
For More info:
Business Continuity Consultancy and Management
info@bccmanagement.com http://www.bccmanagement.com

North America +1.800.961.7592 Fax: +1.613.248.5149 P.O.Box 42054- RPO ST Laurent, Ottawa, Ontario K1k4L8, Canada

Middle East office +961.7061.9274 Fax: +961.923.2406 P.O.Box 116-5108, Beirut, Lebanon

Our Partners:

Business Continuity Management:
Is about anticipating the events or circumstances that could hinder the running of a business, and planning to make sure that the business responds swiftly and continue to function in the event of an emergency. A business continuity plan sets out clear roles and responsibilities, for example those assigned to manage all liaison with customers, employees and the emergency services. It lists a series of contingencies that enable key business activities to continue in the most difficult circumstances.

Some examples of threats to a business are:
• A vital computer system or telecom is unavailable.
• Critical process machinery is damaged.
• Loss of key employees due to sudden death, illness.
• Bomb/Terrorism threat.
• Natural disasters such as tornadoes, floods, earthquakes and fire.
• Pandemics.
• The building, or part of the building, or office, cannot be accessed, and.
• Suppliers are unable to deliver.

What BCCManagement can offer you?
• A full Study for Business Continuity Planning.
• Review existing Business Continuity Plans.
• Business impact analysis.
• I.T Disaster Recovery, Information Technology Solutions.
• Review of disaster recovery plans.
• Awareness and Training.
• Compliance with BS25999.
• I.T Security Consultancy.
• Data Replication Solutions.
• SMS Emergency Notification System

About BCCManagement:
We have been in Business since 2006 we have participated in several related International Conferences and seminars held in many countries including Canada, United Kingdom, and the United States. Also, we published
numerous Business Continuity studies and articles in renowned magazines and international websites, noting that BCCManagement had been actively involved in the development of standards dealing with Business Continuity namely the Business Continuity Standard BS25999.
BCCManagement Professional team is proudly certified by the “Business Continuity Institute (BCI) England” which is the major international players in Business Continuity field.

BCC Management Has partnered with Different Associations and Vendors and professional bodies to being its customers Value added services.

BCI partnership:
Was launched in 2007 to enable organizations to work with the Business Continuity Institute to deliver the overall BCI mission of: Promoting the art and science of business continuity management worldwide.

The Corporate partnership aims to achieve the highest standards of BCM practice Corporate Excellence in Business Continuity Management.

-Bronze level partnership with Business Continuity institutes BCI
-Strategic Golden partnership with Business Continuity ME – BCME
-Disaster Recovery institutes Exchange – DRIE
-Continuity Forum
-Business Continuity software Provider
-Online Data Disk Storage and backup

**Ask For our free analysis on the current Business Continuity status of your organization.

For More info:
Business Continuity Consultancy and Management info@bccmanagement.com http://www.bccmanagement.com
North America +1.800.961.7592 Fax: +1.613.248.5149 P.O.Box 42054- RPO ST Laurent, Ottawa, Ontario K1k4L8, Canada
Middle East office +961.7061.9274 Fax: +961.923.2406 P.O.Box 116-5108, Beirut, Lebanon

TAKING THE NEXT STEP:

ACCORDING TO BSI-GLOBAL

Initial Assessment

Stage 1
The following aspects will be covered:
Review of the organization’s BCMS documentation
High level evaluation of the organization’s readiness

Stage 2 assessment Review the organization’s understanding of the
requirements of the standard Understanding of the proposed scope of the stage 2 assessment
Review and confirm the resources needed for the stage 2 assessment
Plan the stage 2 assessment
Ensure that Management Reviews and audit/self assessments are being planned and performed Any areas deemed not in compliance will be raised as nonconformities and must be cleared and approved by the
lead auditor prior to moving into the Stage 2 phase of the
certification audit.

Stage 2

The purpose of the stage 2 audit is to evaluate the
implementation, including effectiveness, of the
organization’s BCMS.

This phase is carried out using the process audit approach.
Unlike a checklist approach, the audit approach assesses
all processes included in the scope of operation and all linked
processes to ensure effectiveness and consistency. This will
include interviews with the stakeholders, gathering of
objective evidence (procedures, reports and test results)
and evaluating those findings against the standard.
Any areas deemed not in compliance and/or effective will
be raised as nonconformities and must be cleared and
approved by the lead auditor prior to being recommended
for certification.

Surveillance Audit
The first surveillance visit is typically planned to take place
yearly after the date of the stage 2 audit.
BSI will perform periodic monitoring audits of the certified
organization’s BCMS. Typically, an organization may be
visited for such an audit once a year. The purpose of these
monitoring audits is to verify the certified organization’s
continued compliance with certification requirements.
Surveillance audits typically cover critical activities that ensure
continuous improvement and effectiveness such as:
Management review and audits/self assessments
Review of actions taken on nonconformities from previous audits
Effectiveness of the BCMS
Progress of planned activities aimed at continual improvement
Verifying the effective interaction among all BCMS elements
Continuing operational control

Review of any changes
Use of marks and any other reference to certification
Verifying a demonstrated commitment by the organization
to maintaining the BCMS effectiveness

Reassessment

The purpose of the reassessment audit is to confirm the
continued conformity and effectiveness of the BCMS and
its continued relevance and applicability for the scope of
certification. The reassessment audit will typically include
the following aspects:
The effectiveness of the BCMS in its entirety in the light of
internal and external changes and applicability to the
scope of certification.
Demonstrated commitment to maintain the effectiveness
and improvement of the BCMS in order to enhance overall
performance.

Whether the operation of the certified BCMS contributes to
the achievement of the organizations policy and objectives.
All steps noted are typical accepted practice based on ISO 17021
and subject to revision at anytime.

Any areas deemed not in
compliance and/or effective will
be raised as nonconformities and
must be cleared and approved by
the lead auditor prior to being
recommended for certification.

BSI Management Systems How to deploy BS 25999

CONCLUSIONS

BS 25999 establishes the processes, principles and
terminology to address business continuity and availability
risk. It also provides a comprehensive set of controls based on
industry leading practices that help organizations develop,
implement, maintain and mature business continuity
processes. The standard can be used as a framework so that
those organizations without a BCMS can efficiently establish
a workable program, and those that already have a program
can ensure it meets best practices where applicable.
The growing consensus regarding BS 25999, combined with
the opportunity to become certified in its use, provides
unparalleled benefits to companies of all sizes whose
customers rely on their products and services

Reference:
BSI Global

BCI partnership:
Was launched in 2007 to enable organizations to work with the Business Continuity Institute to deliver the overall BCI mission of: Promoting the art and science of business continuity management worldwide.
Corporate partnership aims to achieve the highest standards of BCM practice Corporate Excellence in Business Continuity Management

http://www.bcipartnership.com/

Business Continuity Management:
Is about anticipating the events or circumstances that could hinder the running of a business, and planning to make sure that the business responds swiftly and continue to function in the event of an emergency. A business continuity plan sets out clear roles and responsibilities, for example those assigned to manage all liaison with customers, employees and the emergency services. It lists a series of contingencies that enable key business activities to continue in the most difficult circumstances.

Some examples of threats to a business are:
• A vital computer system or telecom is unavailable.
• Critical process machinery is damaged.
• Loss of key employees due to sudden death, illness.
• Bomb/Terrorism threat.
• Natural disasters such as tornadoes, floods, earthquakes and fire.
• Pandemics.
• The building, or part of the building, or office, cannot be accessed, and.
• Suppliers are unable to deliver.

What BCCManagement can offer you?
• A full Study for Business Continuity Planning.
• Review existing Business Continuity Plans.
• Business impact analysis.
• I.T Disaster Recovery, Information Technology Solutions.
• Review of disaster recovery plans.
• Awareness and Training.
• Compliance with BS25999.
• I.T Security Consultancy.
• Data Replication Solutions.
• SMS Emergency Notification System

About BCCManagement:
We have been in Business since 2006 we have participated in several related International Conferences and seminars held in many countries including Canada, United Kingdom, and the United States. Also, we published
numerous Business Continuity studies and articles in renowned magazines and international websites, noting that BCCManagement had been actively involved in the development of standards dealing with Business Continuity namely the Business Continuity Standard BS25999.
BCCManagement Professional team is proudly certified by the “Business Continuity Institute (BCI) England” which is the major international players in Business Continuity field.

**Ask For our free analysis on the current Business Continuity status of your organization.

For More info:
Business Continuity Consultancy and Management info@bccmanagement.com http://www.bccmanagement.com
North America +1.800.961.7592 Fax: +1.613.248.5149 P.O.Box 42054- RPO ST Laurent, Ottawa, Ontario K1k4L8, Canada
Middle East office +961.7061.9274 Fax: +961.923.2406 P.O.Box 116-5108, Beirut, Lebanon


vtey2faukx

13 JULY 2009 | GENEVA — On 7 July 2009, the Strategic Advisory Group of Experts (SAGE) on Immunization held an extraordinary meeting in Geneva to discuss issues and make recommendations related to vaccine for the pandemic (H1N1) 2009.

SAGE reviewed the current pandemic situation, the current status of seasonal vaccine production and potential A(H1N1) vaccine production capacity, and considered potential options for vaccine use.

The experts identified three different objectives that countries could adopt as part of their pandemic vaccination strategy:

* protect the integrity of the health-care system and the country’s critical infrastructure;
* reduce morbidity and mortality; and
* reduce transmission of the pandemic virus within communities.

Countries could use a variety of vaccine deployment strategies to reach these objectives but any strategy should reflect the country’s epidemiological situation, resources and ability to access vaccine, to implement vaccination campaigns in the targeted groups, and to use other non-vaccine mitigation measures.

Although the severity of the pandemic is currently considered to be moderate with most patients experiencing uncomplicated, self-limited illness, some groups such as pregnant women and persons with asthma and other chronic conditions such as morbid obesity appear to be at increased risk for severe disease and death from infection.

Since the spread of the pandemic virus is considered unstoppable, vaccine will be needed in all countries. SAGE emphasized the importance of striving to achieve equity among countries to access vaccines developed in response to the pandemic (H1N1) 2009

The following recommendations were provided to the WHO Director-General:

* All countries should immunize their health-care workers as a first priority to protect the essential health infrastructure. As vaccines available initially will not be sufficient, a step-wise approach to vaccinate particular groups may be considered. SAGE suggested the following groups for consideration, noting that countries need to determine their order of priority based on country-specific conditions: pregnant women; those aged above 6 months with one of several chronic medical conditions; healthy young adults of 15 to 49 years of age; healthy children; healthy adults of 50 to 64 years of age; and healthy adults of 65 years of age and above.
* Since new technologies are involved in the production of some pandemic vaccines, which have not yet been extensively evaluated for their safety in certain population groups, it is very important to implement post-marketing surveillance of the highest possible quality. In addition, rapid sharing of the results of immunogenicity and post-marketing safety and effectiveness studies among the international community will be essential for allowing countries to make necessary adjustments to their vaccination policies.
* In view of the anticipated limited vaccine availability at global level and the potential need to protect against “drifted” strains of virus, SAGE recommended that promoting production and use of vaccines such as those that are formulated with oil-in-water adjuvants and live attenuated influenza vaccines was important.
* As most of the production of the seasonal vaccine for the 2009-2010 influenza season in the northern hemisphere is almost complete and is therefore unlikely to affect production of pandemic vaccine, SAGE did not consider that there was a need to recommend a “switch” from seasonal to pandemic vaccine production.

WHO Director-General Dr Margaret Chan endorsed the above recommendations on 11 July 2009, recognizing that they were well adapted to the current pandemic situation. She also noted that the recommendations will need to be changed if and when new evidence become available.

SAGE was established by the WHO Director-General in 1999 as the principal advisory group to WHO for vaccines and immunization. It comprises 15 members who serve in their personal capacity and represent a broad range of disciplines from around the world in the fields such as epidemiology, public health, vaccinology, paediatrics, internal medicine, infectious diseases, immunology, drug regulation, programme management, immunization delivery, and health-care administration.

Additional participants in the SAGE meeting included members of the ad hoc policy advisory working group on influenza A(H1N1) vaccine, chairs of the regional technical advisory groups and external experts. Observers included industry representatives and regulators who did not take part in the recommendation process in order to avoid conflicts of interest.

RELATED LINKS
Strategic Advisory Group of Experts (SAGE) on Immunization

Pandemic (H1N1) 2009: full coverage

WHO

The standard BS 25999 [1]requires the dependencies of critical activities to be identified (other activities, assets, resources, suppliers and outsource partners).

BS 25999-2, 20 Nov. 2007 Section 4 says that the goal of a Business Impact Analysis BIA is to “determine the impact of any disruption of the activities that support the organization’s key products and services.”

A key aspect of determining the impact of a disruption is identifying what BS 25999 calls the “Maximum Tolerable Period of Disruption,” or MTPOD.

BS 25999 defines MTPOD as the “duration after which an organization’s viability will be irrevocably threatened if product and service delivery cannot be resumed.”

MTPOD is just a useful metric that determines how much unavailability you can stand before everything crashes and burns and can’t be put back together again.

A corrigendum by Jacque Rupert for BS 25999’,Maximum Tolerable Period of Disruption, which was approved on June 9th 2009 by [[3]]BSI’s BCM/1 standard development committee.

MTPOD is the maximum amount of time that an enterprise’s key products or services can be unavailable or undeliverable before its stakeholders see unacceptable consequences.

BCC management BCCManagement.com has been in business since 2006. It specializes in business continuity, disaster recovery planning, and strategic reviews of conceptual plans. www.BCCManagement.com

References:
2. ^ http://www.bsi-global.com/
1. ^ http://www.continuitycentral.com/feature0675.html
1. ^ http://www.continuitycentral.com/feature0677.html
1. ^ http://www.bccmanagement.com/mtpod.html
1. ^ http://e-janco.com
1. ^ http://en.wikipedia.org/wiki/BS_25999
1. ^ http://en.wikipedia.org/wiki/BSI_Group
1. ^ http://en.wikipedia.org/wiki/Maximum_Tolerable_Period_of_Disruption

Further reading

BS 25999-1:2006 Business Continuity Management Part 1 – [[4]]British Standards Institution
BS 25999-2:2007 Business Continuity Management Part 2 – [[5]]British Standards Institution