The ‘pro and cons’ for Emergency Notification Systems

Emergency Notification Systems (ENS) Social Media and Text Messaging/SMS programmes are quickly becoming commonplace in an effort to provide alerts, news and information that is timely and accurate during an incident. The challenge now is to make them work in a way that fits.   
Essentially, ENS is a system that allows one person to create a message and then send it out to large groups of people all at once. Sending these by phone, SMS or email, it should be able to provide an automated solution to inform groups and individuals on emergencies.

However, there are both ‘Pros and Cons’ to using an ENS.

If I first look at the positives:

·         Most ENS are able to send a ‘one step’ voice or text message and email an entire organisation very quickly with pre-programmed messages. 

·         That speed offers real time accurate and consistent communications with the potential for follow up instructions, reports and assistance.  

·         It also supports notification to all critical members within an enterprise and allows a short notice capacity for discussion and immediate response

·         It can target specific groups, such as sending a special message to initial responders and this can only help in an emergency situation. 

·         Some, but not all of the systems, operate a feature called ‘inbound calling’, confirming that key initial responders have successfully received the message.

There are however some points to consider:

·         There is a chance that the ENS will have a glitch. Though it is unlikely, it is important to have back up information that is available for use if the ENS does not work.

·         It is also very important to have this system well tested and integrated within your organization. In many cases there can be mistakes and issues that are a user error and not just a system failure

·         The notification system is only as good as the information that is documented in the ENS. This can be tested in training and exercising, sending a message through the ENS to inform your employees and then check for currency.  For the employees that do not receive the message, there needs to be a system to have them update the information in the system

·         We need to be sure that mobile networks can cope with emergency-scale traffic volumes via SMS, targeting users by location is difficult, and there is no way to authenticate a message

·         When there is more than one party distributing information there is a strong possibility of different levels and quality of information all coming at the same time from a variety of sources, perhaps leading to saturation, misinformation and/or confusion all of which contribute to a functional fail.

·         Some employees may not have mobile service in the building or may have their mobile phone off while at work, which will limit the effectiveness of the ENS. By having the message sent out multiple ways and to different devises, i.e. mobile phone, email, desk phone, etc. will limit the likelihood that the message will not be received

·         It is difficult to determine cost to value.  When looking at an emergency notification system it is important to consider the features that are included, whether there are limits to the number of contacts or groups you can have, and what additional fees there may be, such as overage costs or setup fees

As with all types of notification systems there are both technical and human considerations. Perhaps most importantly it is the pro-active management of these two elements that will ultimately determine whether ENS becomes more established and a fundamental part of a complete automated emergency information process.

Michael Bourton, Senior Security Specialist

ISO 22301 Certification

CQR UK Obtains ISO 22301 Certification

Why?

Delivering BCMS for our customers across an international market is currently one of our main service offerings.  In delivering BCMS we advise and support our customers on what they need to ensure they have good Business Continuity practices in place, on how they can make their organisation more resilient and how they can mitigate and reduce impact should they be affected by an incident.

Not only is it common sense that we ‘practice what we preach’ but it provides reassurance to our customers and those looking to work with us, we know what we are doing.  If we are able to demonstrate that our own house is in order and that we are certified against recognised International Standards, we can ensure that the needs of our customers are exceeded and that we are continually focusing our efforts on delivering quality services.

We are proud of our core values – passion, knowledge, integrity and accountability and believe that obtaining certification clearly demonstrates our commitment to providing consistent, reliable and dependable expertise, along with a competitive advantage in being able to offer a differentiation of service.

How?

Being already certified for ISO/IEC 27001 Information Security Management Systems, CQR UK had a head start when it came to expanding their credentials and obtaining certification to the ISO 22301 Business Continuity Management Systems.  

For CQR UK, this was not only seen as an opportunity to complete a refresh of our own BCMS but as an opportunity to provide training to members of our staff who are relatively new to the world of Business Continuity.  It’s important that we look to develop our staff and involve them with the continued success and growth of the company.  Involving our staff provided them with the opportunity to learn and gain experience, not only on how to deploy a strong BCMS aligned to the requirements of the standard but the opportunity to experience how an audit is performed. 

Preparing for the audit was given full commitment from our management team.  Time and effort was allocated to allow us to review our procedures and to improve them in line with the requirements of the International Standard.  We completed a pre-assessment and gap analysis which helped to identify areas of improvement and allowed us to apply lessons learned to help improve our own BCMS and our customers.  Aligning to the standard allowed us to focus our efforts on the framework, explicitly in terms of interested parties, legal and regulatory requirements, risk management and management reviews of the effectiveness of our BCMS.

The audit process itself was relatively straightforward; the legwork had been done so it came as no surprise that when we completed the Stage 1 assessment in March our auditor reported no non-conformities.  Stage 2 and subsequent certification was achieved in April.

Benefits

There are many benefits in achieving certification, being able to demonstrate our commitment to Business Continuity Management Systems and provide assurance to our customers that we deliver quality and knowledgeable services goes without saying.  Certification will also help us expand and provide us with a competitive advantage.  We can easily demonstrate our commitment to fulfil new tender requirements and win new business.

Obtaining certification gave us the opportunity to improve the maturity of our own BCMS and helped to ensure we had a consistent documented approach that could also be used to benefit the implementation of BCMS within our customer organisations.

Completing the certification provided us with the opportunity to continuously improve our own BC processes and procedures, ensuring that we can maintain our operations with minimal disruption should we ourselves be impacted by an incident.

Certification enables us to demonstrate to both our internal and external interested parties that we have robust management systems in place to cope with a business interruption and this isn’t just us saying this, it has been validated by an independent external auditor.

What next?

We will look to continually improve our BCMS not only in-house for CQR UK operations but looking to expand our certification to include our operations within our sister organisation in Australia.  On-going assessment will be completed to ensure that our BCMS not only continues to meet the requirements of the standard but provides us with the on-going opportunity to continually improve.

We will also be looking after our customers, providing support and assistance to those that wish to obtain certification or continually improving their existing BCMS to align to the recognised practices of the standard.

Our thoughts

"CQR are thrilled to add ISO 22301 with our ISO 27001 certification enabling us to operate an integrated management system.  This demonstrates our Business Continuity and Information Security expertise and competence to our clients as a critical service provider.  It reinforces our commitment to clients that we take both Business Continuity and Information Security seriously and demonstrates that we understand what it takes to protect our most important assets our people and business”. Greg Inge, Managing Director

“Obtaining certification against ISO 22301 is a goal I’ve been looking to achieve since joining CQR and I’m extremely proud to have been involved in the process and refresh of our BCMS.  Obtaining certification not only shows that we are capable but also credible in our abilities to deliver great BC systems, for me something that I’m extremely passionate about.  Whilst I did feel apprehensive upon waiting for the arrival of the auditor, I was extremely confident that we had done everything that was required and more to ensure certification was achieved.  In fact, I was so proud of the work undertaken I felt at times I was showing off our achievements even when not asked.  Receiving confirmation that we had no non-conformities was the highlight, although I thought this would be the case, it’s nice to be told.”  Claire Phipps, MBCI

Contact

To find out more about services from CQR UK and how we can support your business, contact us on 01865 882225

Aliens on the roof!

So I've caught your attention... either you’re like me and a bit of a Trekkie and therefore maybe curious about the subject or also like me, you have a passion for Business Continuity and are wondering what on earth I'm talking about!

One vital element of delivering a successful Business Continuity programme and one in my opinion often overlooked is to validate your plans and strategy. This takes time and commitment. In turn this will provide reassurance and confidence, training and awareness, greater understanding of procedures and responsibilities. So how do we achieve this? Simply put we complete exercises, tests, rehearsals. There are many different styles that can be delivered...process driven, call cascades, partial or full invocation, desktop, scenario based and more. 

However, the temptation to simply use the same old format or content over and over again should be avoided. Just because you've changed the location, date or time of the details within the exercise doesn't make it different or acceptable. Where we can truly add value to our Business Continuity programme is to allow us to understand what our core risks and concerns are. Understand where the potential pain is, what the impacts of an incident really are on our core business activities, systems and people. 

Spending quality time on developing an exercise which is fit for purpose is where the true benefits can be gained. Taking the time to understand your local surroundings, potential incidents and challenges enables us to develop something that is realistic, believable and purposeful. 

Even if your only discussing why we do Business Continuity and raising peoples own knowledge and perception of the value, using realistic examples helps to strengthen the justification. 

During my recent travels I've been fortunate to not only raise awareness of Business Continuity but to deliver exercises. I have taken the time to understand the business requirements, the pains and been able to deliver something that is realistic, making a conscious decision to not copy one idea for all. However, as a result I'm now being known as a fortune teller or person of doom! The exercise has gone well, lessons have been learned, objectives achieved, attendees have had fun which is just as well as within a relatively short period of time the example given has happened for real. 

I'm superstitious and now spend time 'knocking on wood' to counter-jinx the topic of discussion. Whilst firmly believing on providing realistic examples I don't actually wish the incident to happen. So, to add to my repertoire I will now throw in the incident whereby 'aliens have landed on the roof', surely that can't happen, can it? 

Claire Phipps, MBCI

Heartache from Heartbleed goes on and on

Following on from our earlier post on the Heartbleed bug we wanted to remind you of some of the lessons learned and also to remind the reader of best practice regarding securing yourselves on the internet.

The Heartbleed bug again demonstrated that regardless of the precautions taken when using the internet you can still fall foul of information release or compromise from third party sites or systems. We no longer (alas) live in a world where trust is implicit and ok.
There was a time (not that long ago) that it was normal to leave your home unlocked and if a stranger asked a question or wanted information then it was ok to answer truthfully. We live now in a world where your information is valued and can be combined to infer more or to become more of a commodity. Your date of birth, place of birth, name of your pet or favourite colour can now aid an adversary to begin unpicking your digital and online identities. The simple passwords that proved to be convenient to remember and use across multiple domains and sites can now come back and result in widespread damage to reputations and credibility. Our online footprint can reveal the actual answers of most typical security questions to a skilled or determined attacker rendering the secrets anything but that.
With the notable exception of Government or Healthcare systems it now could be the time to begin lying on the internet; when I personally sign up for services I take a number of simple precautions that when combined offer more benefits than the truth has and these include (and are not limited to) -

Date of Birth – why does any non official site want or need this information, I’ve not been truthful about answering this question, varying the day, month and year frequently and without any real method apart from not using the actual date.

Place of Birth – my Bank knows this, my medical records and passport have this but why should a website want or need the real answer?

Pet’s name – I use random values when asked

Address – Unless I’m paying for goods / services or expecting something to be delivered to my home address I will use a fictitious one

The same goes for favourite colour, first car, school, mother’s maiden name - anything that isn’t actually needed is changed and rarely (if at all) the real information supplied. The sites I’m signing up with don’t need the real information; they just want something they can validate you against if you ever need to prove who you are. I make a note of the information given to each site in a note section of the password manager I use, if I ever need to answer the question of “Where did I go to school?” I can check the corresponding details and answer “Third moon of Pluto” (assuming that’s the answer I gave). The exceptions to this are things that I can control or have more authority over (ie: phone or mobile numbers) as these can sometimes be used for two factor authorisation or reset dialogue. If someone is able to clone my phone or steal my handset then I have more to worry about than a password at that point.

The most beneficial two tactics I employ on the internet are using unique email addresses and unique passwords. Not everyone can use the unique email addresses as it needs a suitable email setup to receive the mail, the benefit of having it ensures that if I start getting unwanted 3^rd party email to a unique email address I know that either that email has been sold to spammers or the service I used it with has been compromised; it’s a good safeguard but needs extra effort to manage and check multiple addresses.

The most important single thing that anyone and everyone can do on the internet is to use complicated and unique passwords. There are downsides to this but the protection this one single action allows is worth it. As Heartbleed and high profile breaches have demonstrated, regardless of the steps we take to protect ourselves on the internet we can still fall foul if servers and services are compromised or our data released. If a service or server I subscribe to is breached and my data is released, it’s generally one (unique) email address and one random password lost. I employ a password manager to maintain the majority of my general passwords (this has the benefit of assisting in the memorising of them and the input of the same), I don’t use the password manager for my most important credentials, and these are deliberately not written down anywhere nor saved anywhere where they could be found; they are the exceptions. My password manager also has additional security that allows me to use two factor authentications. I chose and use two factor authentications wherever possible, anything that makes it harder for my credentials to be usurped is worth using.

A typical password I use is limited only by my imagination and the complexity rules of the site I’m signing up with, it’s not unusual for me to use 25+ char passwords that include special characters, upper, lower case and numbers and spaces. They are painful if I have to input them manually anywhere (such as tablets or games consoles) but that annoyance is worth it when I consider the value of the protection of complex passwords that aren’t used anywhere else. If my password needs updating or changing it’s a simple act; if that password or username/password combination is used on all sites the risks of data loss or compromise isn’t something I could or would want to deal with.

The Heartbleed bug will have a long lasting impact, the depth of the problem is still being fully analysed, it’s not just websites that were/are affected, the nature of the modern world means that there are embedded OpenSSL instances in all sorts of unexpected and difficult to patch places (home routers, firewalls, mobile phones and so on). I suspect there will be ongoing attacks for years to come and it should be accepted that some of the vulnerable systems and services will never be fixed or solutions made available. You may be able to trust the online service / bank or the like but that won’t be able to stop you being owned or affected by seemingly safe devices. We cannot be certain where the OpenSSL Heartbleed bug can be found but we can do everything else to minimise the problems caused if we unknowingly have our information disclosed or released.

Anyone that still has an easy or common password needs to rethink how they are potentially exposed if that information or password is released. We in 2014 are still facing an ongoing problem of common passwords breaking security and trust, if you can authenticate to anything using 123456 or password, qwerty or princess, trustno1 or admin or anything that isn’t “complicated” and using all the characters’ available then you’re taking a risk.  I would like to see services and sites ban people from using simple words or limit their choice to alpha numeric alone with fixed max length under 10.

Complexity is good, length is beneficial. Simplicity in passwords should be consigned to the yesteryear when it was ok to leave your car or house unlocked and have a hope that your possessions and property would still be there anytime afterwards. That age has gone, let’s make sure our weak passwords don’t undermine the security in this modern world we live in. The internet is a wonderful place to be but not one you should blindly trust with anything other than unique throwaway information.

Jamie Duxbury, Senior Security Specialist

 

 

Winning the WOBA Small Business Award – Expectations, Experiences, Excitement!

 

As CQR went through the process of attending the WOBA events, completing the application, being judged, attending the celebration event for the finalist announcements it built excitement, doubt and questions of your business as it leads towards the finale – the Awards dinner.  All these were answered when all our staff attended, and we were fortunate to celebrate as we were announced as winners of the Strategic Mentors Small Business Award.  Our congratulation goes to the other finalists and applicants in this category.  They are all wonderfully successful and well-managed businesses.

We are getting ready for the ride of our life as I look to the benefits CQR hopes to experience to drive our continued success through the WOBA program.

We started CQR in the UK based on a shared vision to expand our information security business globally leveraging our existing client relationships.  In essence, we believed that a company who specialised solely in the delivery of information security services could find a niche in the UK and global markets and be successful.  The opportunity was there, the gauntlet thrown down and the challenge accepted.  For the last 3 years, we have lived, and continue to live, that vision.   Now we see our customer base sharing our vision of our independent security services, working as our partners to everyone’s mutual benefit.
Building a successful business from one person is never easy, let alone in a different country which requires sacrifice.  It tends to be our families that pay that price with me based in the UK and my wife and daughter in Australia it is their continuous support, wisdom and loyalty that has contributed to our award.  From a business view we have faced a number of obstacles, establishing our brand, managing our growth, getting the right people, setting up a structure to support them and working globally.  Our biggest challenge was, and continues to be, finding specialists in our field.  We are a professional services company, our people, their skills, characters and commitment are our lifeblood and vital to the success of our business.

I see the benefits of participating in the WOBAs to be many for our business in 2014.  

I recall at the WOBA celebration event it was emphasised at the finalist photo shoot to “shamelessly promote yourself”….  so lesson number one and benefit of being part of the WOBAs is when we have the opportunity we will not to be afraid to promote ourselves. 

The media exposure for us a company will increase and be critical to improve our brand recognition.  It will give us media exposure through papers and websites.  This is publicity at its best and the upside is that doesn’t cost the business any money. 

We aim to further extend the media exposure by utilising the WOBA logos on all our website, sales and marketing collateral.  This reinforces the success of our business with our clients.  We will market our win by sending all our existing and potential clients a news release of our win acknowledging their contribution in supporting us and that they are part of CQR being the small business of the year. 

In the information security marketplace the client relationship and trust is everything.  We deal with risk and many secrets of our clients.  Winning the business award will enable us to further establish or in some cases obtain a key criteria in our industry - credibility.  This helps us as a smaller business compete against our competitors and demonstrates our capability as viewed by industry experts on our business model.  Winning should be able to open doors to immediate business that we have been courting for some time.  Not only is it good for winning new business it can be used by many clients to push up to executive management as a mechanism to support their choice of CQR as a service provider in a changing business environment. 

From a staff and recruitment perspective the benefits will be and have been already great for our business.  We involved our staff through the process as we progressed through the stages.  Where we could we sought their input in our plans so we all had the same vision and understanding where our business was heading.  Staff morale becomes high as they are associated with a business that is interested in their input and ultimately want to be associated with a successful business.  We found that winning the award builds a stronger relationship with our staff and they were just as proud of the achievement and continue to do us proud in working for us.

From a recruitment angle it reinforces with potential candidates that we are successful.  The candidates when they have a choice wish to be part of a successful company that provides a career rather than a job.  The WOBA awards provide this and we have found in a niche services market that this is an important differentiator when recruiting.

The process provides a mechanism for us as a management team to draw breath and take a “reality check”.  Too often we are so involved within our businesses that we fail in getting a holistic view of our progress.  The problem with this is we fail to recognise longer term, or strategic, issues.  The awards process gave us the opportunity to stand back and take a more objective view of our business.  It will also keep us focussed on continuing with these efforts to ensure we adjust when needed.

The process forced us to take a closer look at what we are doing.  This was across all parts of our business, including how we value and reward our people, how effective our systems and processes are, did we really understand what we wanted to achieve with some of the parts of the business.  We had the chance to assess ourselves against what our vision of each of these areas was and also to assess whether we were effective in getting to where we wanted to be.

The awards process allowed us to go back into our business and try to understand where we were failing to hit objectives.  Talking to our staff and clients about specific processes, the benefits and hindrances about how we went about delivering our services, the things we may be able to improve on and what tools might assist them in achieving our shared goals.

The downside to the process is really psychological.  When we take time to examine our business closely, we find some of the weaknesses that have either been there from the start, or have been introduced during the growth of the business.   The issue here is how we respond and measure ourselves this year.   When we realise the problems, we can respond in a negative manner and become defocused, or we can recognise that there is a price to pay for growth and that means that everything is never going to be perfect.   The opportunity must be seized and strategies identified to ensure that all within the business are working to continuously improve all aspects of how we operate and deliver our services.   Omissions and errors are opportunities for improvement.

I strongly recommend businesses to get involved in WOBA, whether you win or lose, the benefits of WOBA for your business are huge, CQR sees them as:

1. Opportunity to shamelessly promote our business

2. Association with recognised brands such as WOBA, Strategic Mentors and benefiting from their products and sponsorship

3. Credibility, status within the business world no matter what size we are!

4. Sales, it generates sales and immediately

5. Marketing and Media, utilising the free media exposure and brand logos within our business.

6. Recruitment, people want to work and belong to a successful company

7. It is a reality check by taking a holistic view of our business and by reviewing our business vision at a more detailed level.

8. It Identified where we were not hitting our business objectives and enabled us to respond

9. The process was a reinforcement from an independent panel that were doing things right

The biggest thrill of the Award is sharing the success with our staff and partners, after all everyone is working towards the same goal – our business success.

Greg Inge
Managing Director CQR UK

 



Business Continuity Awareness Week

Let me get this right - we have Shrove Tuesday, Mother's day and then Business Continuity Awareness week. I hope I can get the right card from Moonpig.com. I bet there is one!

Speaking as a man on a mission to sell the positive impact of effective Business Continuity I am going to do my bit. I will be doing it in the Philippines incidentally, with a Business Continuity Awareness week for an offshore provider, but no matter where you are, we in the business need more than a real incident to keep the focus where it should be. We need to channel our efforts to explain, to sell and in some cases to preach the huge benefits of a well-oiled Business Continuity Management system.

Too often a business works on the philosophy of 'it won't happen to us' or 'we don't have the budget this year'. Our message should be one of that it might happen to you and actually we can save you money with a good system in place. We can help drive efficiencies, help identify and minimise risk.

So let's use this awareness week to do just that - to get out there and using really good examples convince where we can, to anyone uncertain or unsure about just what can be achieved in managing a business. I give lectures to some very senior people about Business Continuity and often find the key is to look them straight in the eye and relate it directly to them. Not necessarily about their business, but about their life - how do they manage when something happens at home - do they make changes to avoid it happening again - do they protect and try and minimise the chance of harm to their family. Of course they do. It works as an argument and it is then easy to scale it up to a business. Keep communication paths strong, clear and direct; keep solutions simple and keep re-evaluating the risk.

Now trying to keep the agenda focused is clearly a challenge and when everything is going smoothly complacency can kick in so we must make the interaction constant, always be prepared to enthuse, and drive home the benefits. This shouldn't be Business Continuity Awareness week but rather Business Continuity Awareness Life until such time as it is instinctive in companies to measure their appetite to counter risk against a fully maintained and mature Business Continuity Management system. That may never happen but that doesn't stop us trying. We teach our children road safety, we don't stop that after one little talk, and we are always looking out for them until they can support their own children. In an obscure way it's the same for our profession; our role is to teach, to train and pass on our skills until the next generation of continuity professionals takes over. Blimey I sound like I'm about to retire - well not yet. I still have a mission and I will stoke up the fire and get out there for this week and the next and the next.

Now does anyone have a stamp for my card?

Mike Bourton

University, Career, Real World Security

I am new to the world of business continuity and information security so this is my story so far. At college my interests ranged from geology to politics so I became accustom to the fact that our world is ever changing and we must find new ways of dealing with this. I found the perfect degree which enabled me to further my interests. This was the Disaster Management (BSc) degree at Coventry University where I graduated in November 2012. During my degree I covered subjects from natural hazards to emergency planning and business resilience. Whilst at university I attended a number of business continuity focussed conferences which were my first insights to the industry and gaining concepts of threats and vulnerabilities facing businesses.  Furthermore I took the opportunity to build my business and personal networks.

At university I gained key experience in ‘hands on’ disaster management exercises. One of these involved the scenario of emergency response to a plane crash and the objective was to rescue the passengers and get them to hospital with limited information and resources provided. This occurred in Wales in the freezing winter, where my home for several nights consisted of wood, plastic poles, rope and tarpaulin which when put together created something surprisingly warm. We were being graded under a number of criteria, including teamwork, leadership, communication, utilisation of resources and time. As a group of students who were still learning, it was an exercise that focussed on developing and understanding each other’s skills and the benefits we could bring to the task, whilst working under pressure and difficult conditions to respond to a disaster scenario.

Following my degree, I wanted to experience the real world of disaster management. As daunting as it sounded I was eager to put what I had learnt into practice. I contacted a large local authority to volunteer for their emergency planning team. A placement opportunity was created and I gained 10 months of experience and skills in emergency planning.  As a very interesting sector to work in I found it be unpredictable and the job role was to protect the safety of people and businesses against significant threats under civil contingencies act.   A key activity I participated in was the review of the “Control of Major Accidents and Hazards” (COMAH) regulations and offsite plans which included participation in training for the duty officers.

I was eager to learn more and to break into my career, business continuity is not an easy industry to enter as a graduate.  I had the passion and drive, but without experience I couldn’t gain experience.  I joined the steering committee of XGen Business Risk and Resilience, an organisation focussed on developing the skills of qualified resilience practitioners and introducing newcomers to the industry. This enabled me to develop my networking relationships and provide opportunities to show my capabilities for any potential job. During my time on the committee I have been a part of organising a conference for businesses with guest speakers on a number of subjects that include cyber security and business resiliency.

Opportunities were presented though social media. I had work experience within a local authority and I wanted to further my career in the private sector. I was scooped up by CQR as they recognised my passion and drive towards my career in risk and resiliency.  I have been thrown into the world of security and resiliency and it is living up to my expectations. My first 3 months have been a great learning curve in not only understanding our methodologies and approach to our service delivery but also understand how we work with our clients and how their business operates.  So far my projects have included business continuity plan maintenance, third party business resiliency assessments, development of a building recovery plan, creating governance maturity models for global business continuity program. 

 

Georgina Collett, Information Security Specialist