BUSINESS CONTINUITY MANAGEMENT AND MUTUAL AID
From studying the crisis responses that have been published and via several interviews with network operators, it became apparent that a business continuity management (BCM) plan does not always exist or is not up to date, leading to many failures being addressed in an ad hoc manner. When investigating the incidents that were successfully overcome with minimal impact, mutual aid between operators (e.g., in temporarily lending equipment or routing traffic over another ISP’s infrastructure) seemed to be a key factor to challenge containment. On one hand, this underlines the importance of BCM. Moreover, the extent of BCM policies and planned responses, if they exist at all (typically only at larger operators), tend to greatly differ between network operators. On the other hand, this also highlights the fact that resilience engineering is not and should not be limited to a single network. When addressing global incidents, it is important to have coordinated actions or agreements where one can rely on someone else’s network for offloading traffic. Following such approaches similarly for the technical side of network design and resilience optimization would allow higher resilience levels for a particular deployment to be achieved at a lower overall cost and network complexity; as in insurance, risk and impact are distributed over more shoulders