Chapter 9 Resilience and Physical Security

Backup Strategies

• Full Backups require more storage space and are not practical for frequent use compared to incremental backups, which capture only the changes since the last backup and save space.
• Incremental backups must be layered for restoration to a full backup point, particularly in case of failures, easier and faster but involve multiple recovery steps.
• Organizations typically balance periodic full backups with frequent incremental backups due to cost and space considerations.

Data Replication

• Replication continuously copies live data to another location using either synchronous (real-time) or asynchronous (delayed) methods.
• Synchronous replication occurs in real time, while asynchronous replication records changes regularly but after they happen, beneficial for disaster recovery and availability.
• Supports multisite and multisystem architectures, ensuring consistent data across systems.

Journaling

• Journaling logs changes that can be replayed for recovery, used primarily in databases and virtual environments, enabling restoration to specific points in time.
• Not a complete backup solution as a journal must be secured externally to prevent data loss from failures.
• Restoration from journals can slow down the recovery process; thus, it should complement other backup methods.

Recovery Objectives

• Recovery Point Objectives (RPOs) define acceptable data loss limits, directly influenced by backup frequency.
• Recovery Time Objectives (RTOs) determine acceptable downtime, influencing design choices to facilitate quick restorations.
• Balancing RPOs and RTOs reflects the organization’s tolerance for data loss and impacts recovery strategies and associated costs.

Snapshot and Image Backups

• Snapshots capture the entire system state at a specific point in time, popular in virtual machines for easy restoration or cloning of environments.
• Images refer to complete, bit-level copies of systems, retaining all configurations, ideal for quick restoration.
• Both snapshots and images can be taken live and may use compression to save storage.

RAID Configurations

• RAID 1 (Mirroring) offers redundancy by duplicating data across drives but consumes twice the storage space; it enhances read speeds.
• RAID 5 (Striping with Parity) provides data distribution across drives with fault tolerance for one drive failure; rebuild time can impact performance.
• RAID 10 (Combined Mirroring and Striping) requires at least four drives to harness benefits of both RAID 0 and RAID 1 but is more costly.

Backup Types

• Backups include full, incremental, and differential; each serves distinct needs in relation to speed, recovery time, and data change frequency.
• Full backups consist of complete data copies, incremental backups only capture changes, and differential backups save changes since the last full backup.
• Forensic images ensure secure handling and validation during storage duplication processes.

Backup Media Considerations

• Backup media choices (tape, cloud, etc.) depend on factors like capacity, reliability, speed, cost, and data lifespan.
• Magnetic tape remains popular for large-scale backups due to low cost-per-capacity and reliability, even as many enterprise organizations shift to cloud options.
• Tape robot systems allow for efficient management of large volumes of backup tapes.

Site Resilience

• Organizations plan for infrastructure outages by considering site resilience options.
• Site resilience is a crucial design element for some organizations.
• There are three types of disaster recovery sites used for site resilience: hot sites, warm sites, and cold sites.

Hot Sites

• Hot sites have all the necessary infrastructure and data to operate an organization.
• Some organizations operate hot sites full-time, splitting traffic and load between multiple sites for performance and staff availability.

Warm Sites

• Warm sites have some or all of the systems needed for an organization but lack live data.
• They are expensive to maintain due to hardware costs but reduce restoration time as systems are ready to go.
• Offer a balance between hot sites and cold sites in terms of cost and capabilities.

Cold Sites

• Cold sites provide space, power, and network connectivity but lack systems and data.
• Organizations would have to acquire systems and transport data in case of disaster.
• Cold sites are the least expensive option to maintain.

Restoration Order

• The order in which systems are restored is crucial for a successful disaster recovery.
• The order prioritizes critical systems and services necessary for the organization's operation.
• A typical restoration order prioritizes network connectivity, security, storage, critical servers, logging and monitoring, and other services.

Restoration Order Examples

• 1. Restore network connectivity and a bastion host: Establishes initial access and secure connection.
• 2. Restore network security devices (firewall, IPS): Secures the network from external threats.
• 3. Restore storage and database services: Enables access to critical data.
• 4. Restore critical operational servers: Brings essential services like applications and infrastructure online.
• 5. Restore logging and monitoring service: Provides visibility into the recovery process and potential issues.
• 6. Restore other services as possible: Gradually brings remaining services online.

Capacity Planning for Resilience and Recovery

• Capacity planning ensures availability of resources, including staff, technology, and infrastructure, when needed.
• Traditionally, organizations heavily invested in physical infrastructure for disaster recovery.
• Cloud services offer flexibility by outsourcing technology and infrastructure needs.
• The Security+ exam focuses on capacity planning for people, technology, and infrastructure.

Capacity Planning for People

• Staffing and skills are crucial for handling increased workload and disasters.
• Organizations typically maintain sufficient staff for adequate coverage.
• Global staffing ensures coverage throughout the business day for large organizations.
• Third-party solutions like support contracts, consultants, and cloud services can address staffing capacity needs.

Capacity Planning for Technology

• Understanding an organization's technology deployment and scaling capabilities is important.
• Technology capacity planning involves assessing the capacity of tools like web servers, load balancers, and storage devices.
• It is closely linked to infrastructure capacity planning and may be difficult to distinguish.

Capacity Planning for Infrastructure

• Underlying systems and networks need to scale for changing loads and disaster recovery.
• Infrastructure capacity planning includes network connectivity, throughput, storage, and other elements crucial for handling workload fluctuations and business continuity.

Testing Resilience and Recovery Controls and Designs

• Testing and validating resilience and recovery controls are essential.
• The Security+ exam covers four common testing methods: tabletop exercises, simulation exercises, parallel processing exercises, and failover exercises.
• Tabletop exercises use discussions to validate plan effectiveness. They involve the least disruption but lack real-world application.
• Simulation exercises simulate real events, allowing personnel to practice procedures. It's crucial to ensure staff understands the simulation to avoid disruption.
• Parallel processing exercises validate backup systems by moving processing to alternative resources. Disruption can occur if processing isn't properly separated.
• Failover exercises test full failover to backup systems. They are the most disruptive but provide a real-world test scenario.
• Documentation, analysis, and application of lessons learned from all testing methods contribute to improving resilience and recovery processes.

Tabletop Exercises

• Tabletop exercises involve discussions between personnel assigned roles relevant to the plan, to validate the plan's effectiveness
• They help identify missing components or processes within the plan
• Tabletop exercises are the least disruptive testing method but also have the least connection to reality, potentially missing issues that other methods would detect

Simulation Exercises

• Simulation exercises involve drills or practices where personnel simulate actions they would take during an actual event
• It's crucial to ensure all staff understand the exercise is a simulation, as performing actual actions could cause disruptions

Parallel Processing Exercises

• Parallel processing exercises involve moving processing to a hot site or alternative/backup system/facility, to validate the backup's functionality
• There's potential for disruption if processing isn't properly separated, and the parallel system attempts to take over the primary system's data processing

Failover Exercises

• Failover exercises test the full switch to an alternate site or system, providing the greatest potential for disruption but also the best opportunity for real-world testing

This quiz explores various data backup strategies, focusing on the differences between full backups and incremental backups. Understand the benefits and drawbacks of each approach, as well as the role of replication in data management. Test your knowledge on how organizations choose the best practices for data protection.