İş sürekliliği yönetiminde analiz ve planlama için bayes ağlarına dayalı bir model
A model for analysis and planning in business continuity management with bayesian networks
Yazar: ZEYNEP ÇAKIR SAYGILI
Danışman: DOÇ. DR. UMUT ASAN
İstanbul Teknik Üniversitesi / Fen Bilimleri Enstitüsü / Endüstri Mühendisliği Ana Bilim Dalı / Mühendislik Yönetimi Bilim Dalı
Derece: Yüksek Lisans, 2019
Konu: Endüstri ve Endüstri Mühendisliği = Industrial and Industrial Engineering

Özet:
Tüm dünyada meydana gelen doğal felaketler, çevresel kazalar, siber saldırılar, bilgi
teknolojileri sistemlerinde meydana gelen hata ve arızalar organizasyonlarda kriz
yönetimi, felaketten kurtarma ve acil durum planlaması gibi konulara verilen önemin
giderek artmasında önemli rol oynamaktadır. Olağanüstü bir durumla karşılaşan
organizasyonlar; finansal kayıplar, müşteri şikayetleri ve kayıpları, marka imajının
zedelenmesi, cezai yaptırımlar, insan kaynağının zarar görmesi gibi sorunlar ile
yüzleşmekte, çoğu zaman ise telafi edilemeyecek hasarlar alarak faaliyetlerine son
vermektedirler.
Organizasyonların yaşamlarını devam ettirebilmeleri, faaliyetlerinin devamlılığını
güvence altına almaları, iş kesintisiyle sonuçlanabilecek tüm bu olaylara hazırlıklı
olmaları için iş sürekliliği yönetimini gündemlerine taşımaları gerekmektedir.
Organizasyonel esnekliğin artırılması ve iş kesintileri ile başa çıkabilmek için, iş
sürekliliği çalışmalarının özellikle yönetimin gündemine girmesi ve nitelikli
çalışmaların yapılması sağlanmalıdır.
İş sürekliliği yönetimi ISO 22301'e (2012) göre; "Organizasyona yönelik olası
tehditleri ve söz konusu tehditlerin gerçekleşmesi durumunda iş ile ilgili faaliyetlere
etkisini tespit eden ve organizasyonun paydaşlarının menfaatini, itibarını, marka ve
değer yaratan faaliyetlerini koruyan etkili bir karşılık verme yeteneğiyle
organizasyonel esnekliğin oluşması için bir altyapı ortaya koyan bütüncül yönetim
süreci" olarak tanımlanmaktadır.
İş sürekliliği yönetimi için uluslararası organizasyonlar tarafından birçok standart ve
çerçeve ile temel gereksinimler tanımlanmış, iş sürekliliğinin bir program yönetimi
olarak ele alınması ve sürdürülebilirliği için temel adımlar önerilmiştir. İş sürekliliği
disiplininde iş etki analizi, risk yönetimi, strateji belirleme, iş sürekliliği planlarının
oluşturulması gibi birçok özel çalışma adreslenmiştir. Tüm bu çalışmalar için yöntem
konusunda az miktarda literatür çalışması ve uygulama pratiği bulunduğu
gözlemlenmektedir.
Bu çalışmada iş sürekliliği yönetimi için bütünsel bir analiz ve planlama çerçevesi için
Bayes Ağları ile bir model önerisinde bulunulmuştur. Çalışmada odaklanılan nokta,
olasılıksal analiz ve uzman görüşlerine dayalı, sistematik ve kantitatif sonuçlar
üretebilen, analiz ve planlama aşamaları arasında etkileşimi sağlayabilen bir yaklaşım
ortaya konulmasıdır. Çalışma için İş Sürekliliği Yönetimi ve Bayes Ağları konusunda
literatür araştırması yapılmış, ardından uzman görüşlerine dayalı kavramsal model
önerisi sunulmuştur. Modelin uygulanabilmesi için iki farklı işletme modelini
tanımlayan iki adet örnek vaka hazırlanmıştır. Nihai model ve örnek hazırlanan vakalar
için uzman görüşleri ile hazırlanan veriler Netica programına aktarılmıştır. Farklı olası
durumları değerlendirmek için senaryo analizleri yapılmış ve modelde seçilen farklı
değişkenler için duyarlılık analizleri yapılmıştır. Önerilen modelin geçerliliği 
değerlendirilmiş, sonuçlar irdelenerek çalışmanın katkılarına, eksik yönlerine ve
gelecek için araştırma önerilerine yer verilmiştir

Abstract:
In today's our modern world, business processes, products and services are wanted to
continue without any interrupt, but unfortunately the disruptions are inevitable due to
various events those mankind cannot control. Since the 2000s, natural disasters,
environmental accidents, cyber attacks, failures in information technology systems
play a significant role in increasing the importance for business continuity
management by organizations.
The term "business continuity management" is defined as "holistic management
process that identifies potential threats to an organization and the impacts to business
operations those threats, if realized, might cause, and which provides a framework for
building organizational resilience with the capability of an effective response that
safeguards the interests of its key stakeholders, reputation, brand and value-creating
activities" in ISO 22301 standard.
The organizations should bring forward the business continuity management to build
a sustainable business, assure the operational resilience and have prepared for all these
events. If the business continuity efforts are supported by the management and
effective studies are performed than the organizational resilience is increased and
business continuity events can be handled.
In recent years, it is seen that with established legal and regulatory requirements some
sectors in Turkey such as telecommunications, finance taken into account the
importance of business continuity. These authoritative requirements are considered
supportive and motivating factors for business continuity studies.
The origin of the business continuity is based on the Disaster Recovery approach that
emerged in the 1950-1960s. The process than first evolved into emergency
management planning, then into the strategic management perspective.
Organizations try to overcome the problems to meeting their goals. In this respect,
disruptions, emergency and unexpected situations and disasters are barriers to the
achievement of the objectives of the organizations and the impact of these events can
be severe enough to end the organization's life. From this perspective, business
continuity management is a discipline that fully supports business objectives and
concerns the whole organization.
A properly managed business continuity program is an insurance for organizations.
However, it is difficult and uncertain to estimate the business continuity events and
their effects that may lead to disruption of products and services delivery. Failure of
correctly analyzing the effects of disruption may lead to mistakes in business
continuity planning.
It is possible to identify the impact of a possible loss, disruption or interruption in
business processes or products/services through business impact analysis. On the other 
hand, the risk management activities are addressed in which events may lead to
disruptions in business processes or the products/services delivered. Business impact
analysis and risk management stages are followed by business continuity strategy
determining and planning in which business impact analysis and risk management
results are used.
There are lots of standards and frameworks which created by international
organizations for business continuity management. Additionaly, the fundamental
procedures are recommended for a program management approach to business
continuity. Business continuity discipline consists specific tools such as business
impact analysis, risk management, strategy determination, building a business
continuity plan. Unfortunately, there is a lack of the methodology in the literature and
in practice. Besides, the main parts of business continuity program such as business
impact analysis, risk assessment etc. are not interactive with each other mostly.
However, business continuity management program without a holistic approach is not
efficient. A business continuity management that can produce systematic, holistic,
valid and consistent results is vital for organizations.
At this point, organizations need analysis and planning methodology that is comply
with the good practices and requirements stated in the standards and frameworks,
systematic, repeatable and compatible with dynamics of the organization. In particular,
the methodologies chosen for business impact analysis and risk management can
produce accurate and consistent results for different experts, systems and processes,
and can be considered as a success factor for a sustainable, repeatable and systematic
approach.
This thesis purposes Bayesian Networks Model to build a complete analysis and
planning framework for business continuity management. The focus of the model is to
build an approach which is based on the probabilistic analysis results and expert
opinions, can create quantitative and systematic outcomes and is able to provide the
interaction between analysis and planning phases of business continuity.
In the stage of model definition, firstly, the literature was carefully reviewed for
business management and Bayesian Networks and than the theorical model which is
based on expert assessments was purposed. Bayesian network model was developed
with expert opinions in the focus of information technologies, and information
technology related resources were included in the model. In the conceptual model, five
variable levels are defined that are "threats", "information technology configuration
items", "information technology products", "business products/business channels",
"business impact areas".
After the finalization of model, two separate sample case study are prepared for model
implementation. These cases are based on two different business model. Case studies
were prepared to be analyzed for common model and variables. In these sample cases,
related data was presented that the experts can determine variable's conditional
probabilities and initial probabilities for Bayesian network model.
In the implementation phase, the experts determined the conditional probability tables
and the first probability tables of some variables of the model according to the sample
cases by group decision method. Since the probability of occurrence of four threat
situations at the same time is very low, the probability of occurrence of each threat
alone was evaluated during the implementation. Thus, eight different scenarios were
run and analysed for two different cases.
The arranged data and the final model are processed by Netica software package for
each of the designated cases. The model analysis is performed for all scenarios and
also the sensitivity analysis is completed for five variables selected from each level of
model and results were reviewed. The results produced by the Bayesian network model
interpreted for each sample business case and threat situation. According to the results,
issues such as critical products and services for companies, risky areas, actions to be
taken and scope of the plan were evaluated.
The validity of the model was evaluated in terms of ISO 22301 Operation part
requirements and a compatibility comparison was made. In addition, it was evaluated
whether the outputs of the model matched the expert expectations. Finally, the
contribution of the proposed Bayesian network model to the literature is examined.
Furthermore, the inadequacies of the approach and future work recommendations are
presented.