How Pandemics Affect Business Processes

It's a sad topic, but it is reality. When a world wide pandemic, like the current swine flu hits, business suffers.

Obvious economic issues come to mind, but what often slips the mind is what affects us even more.

The interruption of normal business processes.

When there is a health risk that requires people to stay home, we often forget that these are the same people that run the modern business, everything from the local corner store right up to the echelons of government are affected by an outbreak.

Not the same as an Earthquake

Business will normally think of disastrous situations, like an earthquake or power outage, and prepare for these, but is that the same as a pandemic health risk?

Should we be taking the same steps to correct the business to maintain operational state?

Well, when we declare a disaster, like a power outage that takes out a data center, everyone picks up and moves to the backup site, maybe across town.

In an earthquake, maybe half your staff are unaccessible and can't make it to the site.

Technology is not to Blame

In a pandemic, the data center is fine, the people are not, and are often quarantined to their residences to minimize the spreading of the virus. This is the opposite of a typical DR plan, and therefor throws a wrench into everything.

Business as usual you think, we have a business continuity plan, will all just work from home. We all have computers at home, phones or cell phones to communicate, it won't be an issue...or will it?

The Scenario

Your business has a major call center that hosts 250 representatives that provide IT support services for financial investors.

In a pandemic, they can't go into the call center. Your DR plan calls for everyone to go to an alternative call center for a disastrous situation. What does the business do?

The investors that are also quarantined have no issue, the data center is up and they have always had remote access into the various financial networks from home, they still need support.

When an investors computer even pauses for a minute, slows down, can't print, they could be loosing hundreds of thousands of dollars during that glitch because they can't issue trade instructions.

Now if they can't get helpdesk support what is going to happen? Financial markets are going crazy around the globe, and that is not good, especially considering the financial crisis we are currently in.

So neither the normal operating business processes, nor the disaster operating processes can correct this issue.

A pandemic is clearly a unique situation, that fortunately does not happen often, but will still bring business to it's knees if they don't consider it.

What to Do

• Don't panic. When you panic you make mistakes.

• Go back to basics, Business Analysis 101, and identify these 'gotcha' type situation in your normal operating processes like the one identified here.

• Bring these quickly to the attention of senior management, but don't come empty handed, have some recommendations or advice.

• It is also a good idea to have financial data ready, because your business will need to spend some money in a very short amount of time. I still know people who don't own a cell phone or have a computer at home.

• Identify critical soft assets (people) if you haven't already done so. This may be in your DR plan. These people are the priority for getting whatever they need for them to operate from their residences.

• Get your IT teams to start doing stress and load tests on the infrastructure. Can you really handle 10,000 concurrent remote sessions to your critical application?

• Help IT or your Service/Help Desk to go over the processes for deploying technology assets, installing VPN clients, getting approvals, etc. Identify ways to streamline process to save time.

• Prepare documentation kits (printed) for your critical soft assets that contains relevant contact information. This may already a part of your DR solution.

• Have your security teams (or representative) do some quick awareness training on the threat of phishing attacks, there is often a sharp increase in these situations.

• Have the proper food and medical supplies available at your organization, including any other branch offices. Those that are tasked to stay behind to keep the business afloat (poor IT guy) may be quarantined at the office.

• Keep yourself and your business current on the issue, news sites may over sensationalize a situation to get readers, but the WHO, Red Cross, CDC, or your local Healthcare provider will not.

Another lesson to learn

It is one of the strangest lessons to learn, people, not technology or even data, are the most valuable asset to any organization, and no matter what line of business you are in, your process can not function effectively without them.

We often scramble in these situations because we don't have time to deal with the unknown or the rare occurrences, and this costs business time, money, and burns everyone out.

When there is a pandemic health risk, you want to be in as healthy state as possible to fight off the virus. Working long hours under stressful conditions works against this.

Author: Stewart Allen is a certified Information Security Consultant with over 12 years of experience performing threat risk assessments, penetration tests, and incident forensic response. Acting as Information Security Advisor, Mr Allen is often utilized for magazines like Dark Reading. Many of his published works have been referenced by some of the top industry resources like Carnegie Mellon, IEEE, and the SANS Institute. If you would like to learn more about the author he can be found on LinkedIn.