Explain the importance of resilience and recovery in security architecture
High availability, site considerations, testing, backups, and power. RPO and RTO in plain terms.
- Reading time
- 20 min read
- Flashcards
- 18 cards
- Practice questions
- 8 questions · 2 PBQs
The last objective, and it closes the availability leg of the CIA triad from 1.2. The recovery site types are the most reliably tested part, and they connect directly to RTO and RPO from 5.2.
Recovery sites
Three, distinguished by how ready they are and what that costs.
Hot site
- Fully equipped, data replicated, ready now
- Switch over in minutes
- Most expensive
Warm site
- Equipment in place, data not current
- Hours to days to restore
- Middle cost
Cold site
- Space and power only
- Days to weeks to stand up
- Cheapest
The tellCost tracks readiness exactly. Your RTO decides which you can accept: a four-hour RTO rules out a cold site regardless of budget.
Check yourself
An organisation has an RTO of two hours for its core trading platform. Which recovery site type is required?
Geographic dispersion means placing recovery capability far enough away that one event cannot affect both sites. A backup data centre in the same flood plain is not dispersion.
High availability
Load balancing
- Distributes traffic across servers
- All nodes work simultaneously
- Also improves performance
Clustering
- Servers act as one system
- Often active/passive failover
- Focused on availability
The tellLoad balancing spreads work. Clustering provides a standby that takes over. Both raise availability by different means.
Platform diversity means not running everything on one vendor or product, so a single vulnerability or vendor failure cannot take down everything at once. Multi-cloud applies the same idea across providers.
Continuity of operations (COOP) is the plan for continuing essential functions when normal systems are unavailable — including manual fallback procedures.
Capacity planning covers people, technology and infrastructure. The people component is the one that gets forgotten: a perfect failover plan fails if only one person knows how to execute it and they are on leave.
Backups
Onsite vs offsite
Onsite restores fastest. Offsite survives an event that destroys the primary site — which is the whole point, and why both are usually kept.
Frequency
Determined by the RPO. An RPO of one hour requires backups at least hourly.
Encryption
Backups contain the same data as production and are frequently less well protected, which makes them an attractive target.
Snapshots
A point-in-time image of a system's state. Fast to take and restore, but usually stored alongside the original, so they do not survive its loss.
Replication
Continuously copying data to another location. Supports a very low RPO — but replicates corruption and ransomware encryption just as faithfully as legitimate changes.
Journaling
Recording changes as they occur so a system can be rolled forward or back to a specific point.
Check yourself
A company replicates its file server to a second site in real time. Ransomware encrypts the primary. What is the likely outcome?
Testing
Recovery capability that has never been tested is an assumption, not a capability. Four types, increasing in realism and disruption:
- Tabletop — discussion only, walking through a scenario
- Simulation — a realistic scenario played out
- Parallel processing — the recovery site runs alongside production, processing the same work, without taking over
- Failover — actually switching to the recovery site
Parallel processing is the useful middle ground: it proves the recovery site genuinely works without risking production.
Power
UPS — battery, bridging seconds to minutes. Its job is to keep systems running long enough for the generator to start or for a clean shutdown. Generator — sustained power for hours or days, but it takes time to start.
They are complementary rather than alternatives: the UPS covers the gap before the generator is running.