CoreQ Academy3.4 Explain the importance of resilience and recovery in security architecture.
Security includes availability. Resilience means you can keep running or recover quickly after failures, disasters and attacks such as ransomware. Untested backups are a hope, not a plan.
High availability
- Load balancing vs. clustering
- Load balancing spreads requests across independent servers; clustering makes multiple servers act as one system, sharing state and taking over for each other.
- Fail over
- Automatically switching to a standby component when the primary fails.
Site considerations
- Hot
- A fully equipped, running duplicate site; recovery in minutes to hours. Most expensive.
- Cold
- Space and power only; equipment and data must be brought in. Cheapest, slowest.
- Warm
- Some equipment and connectivity in place; data must be restored. Middle ground.
- Geographic dispersion
- Placing sites far enough apart that one disaster cannot hit both.
Platform diversity, multi-cloud and continuity
- Platform diversity
- Using different technologies or vendors so one flaw does not affect everything.
- Multi-cloud systems
- Spreading workloads across cloud providers to avoid a single provider outage or lock-in.
- Continuity of operations
- Plans that keep essential functions running during and after a disruption.
Capacity planning
- People
- Enough trained staff, cross-training and succession for critical roles.
- Technology
- Enough compute, storage and licences for normal and peak demand.
- Infrastructure
- Facilities, power, cooling and network capacity.
Testing
- Tabletop exercises
- Discussion-based walk-through of a scenario to check plans and roles. Low cost.
- Fail over (test)
- Actually switching to backup systems to confirm they work.
- Simulation
- Realistic practice of an incident, such as a simulated phishing or ransomware event.
- Parallel processing
- Running the recovery system alongside production to compare results without affecting operations.
Backups
- Onsite/offsite
- Onsite backups restore fast; offsite (or cloud) backups survive site disasters. Use both.
- Frequency
- How often backups run; drives how much data you could lose (RPO).
- Encryption (backups)
- Backups contain everything; encrypt them and protect the keys.
- Snapshots
- Point-in-time copies of a system or volume, fast to create and restore.
- Recovery
- Regularly test restoring, not just backing up.
- Replication
- Copying data continuously or frequently to another system or site.
- Journaling
- Recording changes in a log so data can be replayed or recovered to a point in time.
Power
- Generators
- Provide long-term power during outages; take time to start.
- Uninterruptible power supply (UPS)
- Batteries that provide immediate short-term power and allow a clean shutdown or bridge until generators start.
Check your understanding
Knowledge quiz · pass mark 80%
- Which bridges the gap between a power cut and a generator starting?
- A discussion-based walk-through of a ransomware scenario with key staff is a:
- Backups should be tested by restoring them, not only by checking the job succeeded.
- Placing the DR site 500 km away from headquarters addresses:
- Which site has equipment and data ready to take over almost immediately?
Original CoreQ Academy material, mapped to objective 3.4 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.