asis conf 2014: tabletop exercises for bcp

60
Test Emergency Plans With Tabletop Exercises Robert Carotenuto, CPP, PCI, PSP Douglas Hegley Bruce Segler September 30, 2014

Upload: minneapolis-institute-of-arts

Post on 08-Jun-2015

405 views

Category:

Technology


0 download

DESCRIPTION

Copy of presentation given at the ASIS Conference in Atlanta, Sep-Oct 2014. Co-presenters included Robert Carotenuto from the New York Botanical Gardens and Bruce Segler from the Getty Trust in Los Angeles. We discussed Business Continuity Planning, emergency response planning, and tabletop exercises to help help staff prepare and practice real life scenarios.

TRANSCRIPT

Page 1: ASIS Conf 2014: Tabletop Exercises for BCP

Test Emergency PlansWith

Tabletop Exercises

Robert Carotenuto, CPP, PCI, PSPDouglas HegleyBruce SeglerSeptember 30, 2014

Page 2: ASIS Conf 2014: Tabletop Exercises for BCP

Robert Carotenuto, CPP, PCI, PSPAssociate Vice President for SecurityThe New York Botanical Garden

Page 3: ASIS Conf 2014: Tabletop Exercises for BCP

Arts & Crafts

[email protected]

Page 4: ASIS Conf 2014: Tabletop Exercises for BCP

Set and forget it!

[email protected]

Page 5: ASIS Conf 2014: Tabletop Exercises for BCP

The Big Question

[email protected]

Page 6: ASIS Conf 2014: Tabletop Exercises for BCP

Metrics

[email protected]

Page 7: ASIS Conf 2014: Tabletop Exercises for BCP

One Step at a Time

[email protected]

Page 8: ASIS Conf 2014: Tabletop Exercises for BCP

See the forest . . . and the trees

[email protected]

Page 9: ASIS Conf 2014: Tabletop Exercises for BCP

Chasing Headlines

[email protected]

Page 10: ASIS Conf 2014: Tabletop Exercises for BCP

It’s tough to make predictions, especially about the future.

[email protected]

Page 11: ASIS Conf 2014: Tabletop Exercises for BCP

Murphy’s Law

[email protected]

Page 12: ASIS Conf 2014: Tabletop Exercises for BCP

It ain't over 'til it's over!

[email protected]

Page 13: ASIS Conf 2014: Tabletop Exercises for BCP

Scenario• Thursday, February 2, 2011

• You arrive in the morning to find the following scenario:

• An electrical fire has occurred in your office area overnight.

• Sprinklers extinguished the flames, but there has been extensive fire, water and smoke damage to the entire office area. Your computers, paper files, and office furniture are a total loss.

• Museum objects have not been affected; this is only a business interruption.

[email protected]

Page 14: ASIS Conf 2014: Tabletop Exercises for BCP

Resources

[email protected]

Page 15: ASIS Conf 2014: Tabletop Exercises for BCP

I’m in control here!

[email protected]

Page 16: ASIS Conf 2014: Tabletop Exercises for BCP

Perfect Practice

[email protected]

Page 17: ASIS Conf 2014: Tabletop Exercises for BCP

… You may not even need a table!

Douglas HegleyDirector of TechnologyMinneapolis Institute of Arts

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 18: ASIS Conf 2014: Tabletop Exercises for BCP

Psychology? This BCP needs some serious

analysis

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 19: ASIS Conf 2014: Tabletop Exercises for BCP

Psychology of Preparing for a Bad Event

1. Learning and motivationa. Intrinsic v. Extrinsicb. Memory/Thought Action

2. Deniala. “It won’t happen here”

3. Resistancea. “Not now, I’m too busy”b. “This is just too much, we can’t possibly learn it all”

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 20: ASIS Conf 2014: Tabletop Exercises for BCP

Resistance is … NaturalHumans *instinctively* respond to any type of stress with

anxiety and suspicion, leading to resistance

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 21: ASIS Conf 2014: Tabletop Exercises for BCP

Overcoming Resistance

1. CommunityCohortsPartnership

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 22: ASIS Conf 2014: Tabletop Exercises for BCP

Overcoming Resistance

1. CommunityCohortsPartnership

2. Practice Repetition

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 23: ASIS Conf 2014: Tabletop Exercises for BCP

Overcoming Resistance

1. CommunityCohortsPartnership

2. Practice Repetition

3. Experiential learningLess talking, more doing

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 24: ASIS Conf 2014: Tabletop Exercises for BCP

Honesty+

Confidence

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 25: ASIS Conf 2014: Tabletop Exercises for BCP

(The BCP Tabletop Edition)

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

*

* Well, maybe not “everything”

Page 26: ASIS Conf 2014: Tabletop Exercises for BCP

Scenario(s)Potentially a very deep and complicated rabbit holeK.I.S.S!

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 27: ASIS Conf 2014: Tabletop Exercises for BCP

Top-level buy-inDriven by Executive Leadership

… and they make great surprise guests!

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 28: ASIS Conf 2014: Tabletop Exercises for BCP

Cross-functional team

SecurityIT

Core Business Unit

Exec Sponsor And more …

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 29: ASIS Conf 2014: Tabletop Exercises for BCP

Transparency

• Clear & frequent communication• Demonstrate adaptability

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 30: ASIS Conf 2014: Tabletop Exercises for BCP

Conducting a (tabletop) Exercise

Set aside time and space Consider offsite location if feasible

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 31: ASIS Conf 2014: Tabletop Exercises for BCP

Conducting a (tabletop) ExerciseSet aside time and space

Consider offsite location if feasible

Documents:Checklist/outline of critical processesResources requiredAction Plan – to be completed during the session

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 32: ASIS Conf 2014: Tabletop Exercises for BCP

Conducting a (tabletop) ExerciseSet aside time and space

Consider offsite location if feasible

Documents:Checklist/outline of critical processesResources requiredAction Plan – complete during the session

Emphasize RECOVERYThe emergency is overLet’s get back to business, fast

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 33: ASIS Conf 2014: Tabletop Exercises for BCP

Who Attends?Recommend:

Small groups (3-5 individuals)From 2-4 different departmentsSelected with intention – mix ‘em upDecide: Senior and/or Junior staff

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 34: ASIS Conf 2014: Tabletop Exercises for BCP

Who Attends?Recommend:

Small groups (3-5 individuals)From 2-4 different departmentsIntentional selection – mix ‘em upDecide: Senior and/or Junior staff

WHY?Opportunities for:

Institutional alignmentTeam-building across the enterpriseIncreased capacity

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 35: ASIS Conf 2014: Tabletop Exercises for BCP

Practicing

• Simulation – act it out!• Role-playing

Can be hard to get started• Anxiety and laughter (it’s okay to have fun!)

Emotion + Learning = Higher retention

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 36: ASIS Conf 2014: Tabletop Exercises for BCP

The Power of the Interruption

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 37: ASIS Conf 2014: Tabletop Exercises for BCP

Closing Each Session

Reflect, praise results and effortGather feedback from participantsAsk: Single most-important lesson today? Suggestions for improving this process?

Review the written Action PlansSchedule follow-up session

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 38: ASIS Conf 2014: Tabletop Exercises for BCP

Don’t Delay, Act Today!

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 39: ASIS Conf 2014: Tabletop Exercises for BCP

Do

Learn

Adjust

Do AgainRepeat

Improve

Page 40: ASIS Conf 2014: Tabletop Exercises for BCP
Page 41: ASIS Conf 2014: Tabletop Exercises for BCP

Okay team, let’s debrief on that

last BCP tabletop

They need to document their

procedures

This new iPhone is really big!

I’d like to see more concentration!

The action plan was solid

Including junior staff

was helpful

Page 42: ASIS Conf 2014: Tabletop Exercises for BCP

Keep At It!

Twitter: @dhegleyhttp://www.slideshare.net/dhegley

Page 43: ASIS Conf 2014: Tabletop Exercises for BCP

Disaster Tabletops

Bruce Segler

Security Operations Manager

The J. Paul Getty Trust

September 29, 2014

Page 44: ASIS Conf 2014: Tabletop Exercises for BCP

Ready for…

Page 45: ASIS Conf 2014: Tabletop Exercises for BCP

Earthquake Damage Sustained at Getty Research Institute; Santa Monica, California 1994

Page 46: ASIS Conf 2014: Tabletop Exercises for BCP

Flood Damage; Getty Research Institute, Getty Center 1999

Page 47: ASIS Conf 2014: Tabletop Exercises for BCP
Page 48: ASIS Conf 2014: Tabletop Exercises for BCP

Getty Center

Grand Theft Auto

Page 49: ASIS Conf 2014: Tabletop Exercises for BCP

The Getty Center

Bel Air Fire; November 5, 1961

Page 50: ASIS Conf 2014: Tabletop Exercises for BCP

Bel Air Fire; November 5, 1961

Page 51: ASIS Conf 2014: Tabletop Exercises for BCP

Bel Air Fire; November 5, 1961

Page 52: ASIS Conf 2014: Tabletop Exercises for BCP

Sepulveda Canyon Fire; Getty Center 2009

Page 53: ASIS Conf 2014: Tabletop Exercises for BCP

Sepulveda Canyon Fire; Getty Center 2009

Page 54: ASIS Conf 2014: Tabletop Exercises for BCP

Arts & Crafts

Page 55: ASIS Conf 2014: Tabletop Exercises for BCP

Table Top Exercises in Getty Center E.O.C.

Page 56: ASIS Conf 2014: Tabletop Exercises for BCP

Robust Security Training

Page 57: ASIS Conf 2014: Tabletop Exercises for BCP

SATURDAY

Hans Hoffman-“A Hare in the Forrest”N 102

Page 58: ASIS Conf 2014: Tabletop Exercises for BCP

Emergency Site Evacuation Drills

Page 59: ASIS Conf 2014: Tabletop Exercises for BCP

Tram Evacuation Drills

Page 60: ASIS Conf 2014: Tabletop Exercises for BCP

Questions?