Disaster Recovery and Business Continuity

Disaster Recovery

• Disaster Recovery (DR) focuses on restoring IT infrastructure and data access after a disaster.
• Business Continuity (BC) ensures business operations continue during a disruption.
• DR is about technical recovery, while BC involves broader operational planning.
• DRP includes risk assessment, critical asset identification, backup procedures, recovery steps, communication plans, roles/responsibilities, recovery locations, and system prioritization.
• Cloud-based DR offers flexibility, scalability, faster recovery, redundancy, and failover capabilities.
• RTO is the maximum acceptable time to restore a service after a disruption.
• RPO is the maximum acceptable data loss measured in time.
• RTO and RPO help organizations prioritize recovery efforts and set realistic expectations for restoring services and data.

Business Continuity

• Business Continuity plans ensure essential business functions continue during a disaster.
• Key components include risk assessment, business impact analysis, critical function identification, communication plans, and strategies for maintaining operations under adverse conditions.
• BIA identifies and evaluates the impact of disruptions on business functions.
• BIA prioritizes resources and identifies critical processes that need to be maintained or restored quickly.
• Regular testing of the Business Continuity Plan (e.g., simulations, tabletop exercises) validates its effectiveness, identifies gaps, and familiarizes staff with procedures. This improves overall preparedness and responsiveness.

VLAN (Virtual Local Area Network)

• VLAN is a virtual segmentation within a network that groups devices logically, even if physically connected to different network switches.
• VLANs help separate network traffic and organize devices into distinct segments, improving manageability and security.
• VLAN tagging assigns a VLAN ID to packets, allowing communication between devices on different switches within the same VLAN while controlling data flow.
• VLANs isolate network segments, reducing unauthorized access risk.
• VLANs are used for managing different traffic types (e.g., voice, data, guest traffic).
• VLAN trunking is a technique that allows multiple VLANs to travel through a single physical link (between network devices like switches and routers). VLAN trunking enables VLAN data to travel across multiple switches.

IP Addressing (IPv4 and IPv6)

• IPv4 has a 32-bit addressing scheme, supporting approximately 4.3 billion unique addresses.
• IPv6 has a 128-bit address scheme, supporting a much larger address space.
• IPv4 addresses are typically written in dotted decimal format, while IPv6 uses hexadecimal notation.
• IPv6 was introduced to address IPv4 exhaustion, offering a larger address pool, built-in security features, and simplified address configuration.
• IPv6 improves routing efficiency, simplifying address hierarchies and reducing the need for NAT (Network Address Translation).
• Dual-Stack networks support both IPv4 and IPv6. This facilitates a gradual transition to IPv6.

Virtual Private Network (VPN)

• VPN creates a secure, encrypted connection over a public network, enabling secure access to network resources.
• Remote access VPNs allow users to connect to a network remotely.
• Site-to-site VPNs connect entire networks securely across different locations.
• VPNs use encryption protocols (e.g., IPsec or SSL) to secure data transmission, ensuring confidentiality and integrity.
• Challenges in VPN implementation include performance issues (latency), security vulnerabilities, and scalable management.

Dynamic Host Configuration Protocol (DHCP)

• DHCP automatically assigns IP addresses to devices on a network.
• DHCP reduces manual configuration and simplifies managing IP address allocation.
• DHCP automatically assigns IP addresses from a pool, ensuring each device has a unique address.
• Improper configuration can lead to IP address conflicts, connectivity problems, and overlapping subnets.
• DHCP configuration can be optimized for performance, addressing range availability, and DHCP relay agents for large networks.

Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS)

• IDS monitors network traffic for suspicious activity.
• IPS actively blocks threats in real-time.
• IDS and IPS enhance network security by providing early threat detection and immediate action.
• IDS is passively positioned out-of-band, while IPS is in-line.
• IDS/IPS use signature-based (known threats) or anomaly-based detection (deviations from normal).
• High-traffic networks may overwhelm IDS/IPS, reducing detection accuracy and increasing latency, therefore fine-tuning and resource allocation are essential.

Dynamic Routing Protocols

• Dynamic routing protocols (e.g., RIP and OSPF) automatically adapt to network changes, such as link failures.
• RIP is simpler but less scalable, while OSPF scales better but requires more information to be known by the routers.
• Dynamic routing protocols offer resilience and flexibility by rerouting traffic without manual configuration, which is important for maintaining network operations.

Network Address Translation (NAT)

• NAT translates private IP addresses within a local network to a single public IP address.
• NAT enables multiple devices on a private network to share a single public IP address, conserving IPv4 addresses.
• Static NAT maps one private IP to one public IP.
• Dynamic NAT maps a range of private IPs to a public IP pool.
• PAT maps multiple private IPs to a single public IP using unique port numbers.

Data Redundancy

• Geographic redundancy stores data in multiple locations to ensure accessibility even if one site experiences an outage.
• Data replication copies data across sites to enable quick failover and recovery.
• Geographic redundancy enhances data resilience, but may introduce complexities in data management and increased costs.
• Latency and bandwidth limitations can challenge data synchronization in cross-location data redundancy.
• Data compliance and legal considerations, such as GDPR, require adherence to regulations for storing and accessing data.

Multi-layered Cybersecurity Defense

• Multi-layered security creates multiple barriers for threats, reducing the risk of single points of failure.
• Firewalls, IDS, and antivirus applications provide various security layers.
• Containment, containment, or isolation of a breach is improved by defense-in-depth.
• Multi-layered security offers comprehensive protection, but it may involve increased complexity and higher costs, especially for large networks.

Access Control Lists (ACL)

• ACLs define what traffic is allowed or denied on a network.
• ACLs are implemented on routers, switches, and firewalls.
• They control the flow of data packets based on IP addresses, protocols, or ports.
• ACL controls restrict access to sensitive areas or resources of a network.

Domain Name System (DNS)

• DNS converts human-readable domain names to IP addresses.
• DNS caching improves performance by storing recent domain resolutions locally.
• DNS is vulnerable to attacks like DNS spoofing.
• DNS security measures, such as DNSSEC and secure recursive servers, help mitigate threats.
• DNS supports high availability through failover techniques (where traffic is rerouted to alternative servers).

Layer 3 Switches And Traditional Layer 2 Switches

• Layer 3 switches combine the functions of Layer 2 switches and routers.
• Layer 3 switches improve routing efficiency by processing routing functions directly, enabling data to route effectively between VLANs without additional routers.
• Layer 3 switches handle larger amounts of data traffic/handling large numbers of VLANs without additional routers.
• Layer 3 switches are beneficial in large campus or enterprise environments with multiple subnets or VLANs.

Endpoint Detection and Response (EDR)

• EDR solutions monitor endpoint activities, detect suspicious behavior, and provide swift response.
• EDR helps isolate endpoints that have been compromised, limiting the damage to the systems.
• EDR solutions improve incident response times.
• EDR implementation challenges may include managing false positives, ensuring compatibility with existing systems, and maintaining high visibility across all endpoints.

This quiz explores the critical concepts of Disaster Recovery (DR) and Business Continuity (BC). You will learn about the distinctions between DR and BC, the components of a Disaster Recovery Plan (DRP), and the importance of metrics like RTO and RPO. Ensure your understanding of these essential practices for maintaining operations during disruptions.