- Welcome to Lesson 13, Explain the Importance
of Resilience and Recovery in Security Architecture.
So in this, Lesson 13.1,
we're really gonna focus in on backup and recovery.
Now, backup and recovery processes ensure
that accurate and reliable copies
of data and system configurations are going
to be created, maintained, and tested.
Now, why do we need that?
Because stuff breaks, stuff fails, stuff gets corrupted,
and we wanna make sure
that we have those reliable copies of data
and system configurations so that we can quickly recover.
Now, there are really four categories
of backup and recovery: traditional,
online, replication, and then automation.
Now, traditional backup and recovery generally
uses removable media or a local disk library.
Online backup and recovery preserves data
by creating copies of it and storing them
either in an online or a cloud-based environment.
Replication is the process
of creating and maintaining multiple copies
of data across different locations.
And automation is really our approach
to automated provisioning and replacement.
So we're gonna go
into each one of these a little bit deeper.
So traditional backup is backing
up to removable media, tape or disk.
So it might be from going from disk to tape.
It could be going disk to disk.
It could be going disk to disk to tape.
It could be going disk to disk to cloud.
But regardless of kind of where it's going,
there's three approaches.
There's a full backup, there's a differential backup,
and an incremental backup.
A full backup is going to back up all files.
You give it a target, backups all files.
A differential backup is gonna back
up all files that have been created
or modified since the last full backup.
And what it doesn't do is reset an archive bit
and every file has an archive bit
that, if it's being backed up, gets reset,
but it doesn't reset the archive bit in this case.
An incremental backs up all change files
but an incremental does reset the archive bit.
So let's go through the difference
between differential and incremental.
Let's say I do a full backup on Sunday.
Monday's differential will be what has been created
or modified on Monday.
Tuesday's differential will be what was created
or modified Monday and Tuesday.
Wednesday's differential will be what has been created
or modified Monday, Tuesday, Wednesday.
Why?
Because that archive bit hasn't been reset.
The system says, oh,
I still need to back this up.
Incremental, now if I do a full backup on Sunday,
Monday's incremental is what was created or modified Monday.
Tuesday's incremental
is what's been created or modified Tuesday.
Wednesday's incremental
is what was created or modified Wednesday.
What happens when I have to do a restore?
Well, a full backup, I have a full media.
If it's a differential, I go to the full backup
and the most recent differential.
And if it's incremental, I go to a full backup
and then all of the subsequent incrementals in order.
So, you know, an incremental
will be the fastest backup,
but it will be the slowest recovery.
Now, if I'm going disk to disk,
two common options are gonna be doing it
to a network-attached storage device,
known as a NAS or a storage area network, known as a SAN.
Now, a NAS is just a file dedicated storage device.
It connects over Ethernet.
It is relatively inexpensive to add additional storage,
additional NAS devices as you grow.
A SAN is a specialized high speed
fiber channel network
that provides network access to storage devices.
Now, SANs create an image by mirroring a production disk
to another disk inside a storage array.
Now, there are a number
of different online backup strategies available to us.
One is we could back up right to the cloud,
right, schedule backup to a cloud location,
or to a cloud backup service.
We have an option of disk shadowing.
In disk shadowing, data is going to be written
to and read from to or more independent disks
and the process is transparent to the user.
We're gonna be talking a little bit more
about disk shadowing when we talk about RAID.
And we have electronic vaulting.
Electronic vaulting copies files as they change
and then periodically transmits them
to a secure backup location, and remote journaling copies
and periodically transmits transaction logs
to a backup location.
So just different strategies, right,
to accomplish having, you know, good valid copies.
Let's talk about replication.
There are three primary approaches to replication:
point in time, asynchronous replication, and synchronous.
In a point in time replication, periodic snapshots are taken
and replicated, and if the snapshots are pointer-based,
just the changes are transmitted.
Asynchronous replication is an automated process
that streams copies
of the data to the second location, right?
And the write is considered complete as soon
as the local storage commits.
So remote storage is gonna be updated
with just a slight time lag.
Where synchronous replication is an automated process
that streams copies of data
and both write operations, right,
the local and the remote, must successfully complete
before the system can proceed.
Because our goal with synchronous
is guaranteed zero data loss.
Next up, we have automation strategies.
And automation strategies are most often used
when we're talking about configuration files
for a system or device.
Infrastructure-as-code and immutable system.
Now, you've learned about both of these already.
So this is really a review.
Infrastructure-as-code uses code
or configuration files to manage configurations
and automate the provisioning of infrastructure.
Now, infrastructure-as-code actually solves the problem
of configuration drift.
So what's configuration drift?
Configuration drift is when our primary
and our backup systems over time just change a lot
because we've made changes in one, but not in the other.
And by using these configuration files,
we can make sure that they're staying in sync.
Now, immutability, again, we've already
talked about this one,
is the principle that resources should not be changed,
only created and destroyed.
So for example, using an image
of a system preconfigured to a desired known good state.
What we're really doing here is using automation
to replace rather than to fix.
We need to think
about the inverse relationship between the cost
of disruption and the cost to recover, right?
And try to find the best balance point for our organization.
You know, generally, again, there's an inverse relationship.
The cost of disruption
and the cost to recover, right, are going to cross.
This actually is a really interesting
little graphic and it comes
from National Institute of Standards in Technology.
SP800 Special Publication, 800-34r1.
So how do you make a decision about what type of backup?
You have all these options, right?
How are you gonna make a decision?
Well, again, we're gonna strategically align
with the needs of the organization.
And we are going to take into consideration
cost versus complexity versus availability.
So we have traditional recovery, enhanced recovery,
rapid recovery, and continuous availability, right?
Our traditional recovery being tape backup,
low complexity, low cost,
but our recovery is measured in hours to days.
Our enhanced recovery,
our automated solutions, medium complexity,
fairly low cost still, recovery is measured in hours to days
but we might have more recoverable data.
Rapid recovery is looking at asynchronous replication,
higher complexity, more moderate cost,
but recovery now is measured in minutes to hours.
And lastly, we have continuous availability.
So that's synchronous replication or automation,
high complexity, high cost,
but our recovery is measured in seconds.
So we really need to decide what we need
based on the needs of the organization.
And it doesn't have to be a one-size-fits-all.
We may do traditional recovery
for some data and configuration files.
We may do continuous availability for others, right?
So it's really important
that we look at our enterprise and say
what is going to strategically align with the needs
of our organization in terms of backup and recovery,
taking into consideration
cost versus complexity versus availability.
That, my friends, brings us to a three-second challenge.
Five challenge questions, three seconds each.
You know how to do this.
This backup strategy backs up all files
created or modified since the last full backup.
One, two, three.
It's gonna be a differential.
So everything that's different, think of it that way,
everything that's different from the last backup.
Number two, this process copies transaction change logs
and periodically transmits them to a backup location.
One, two, three.
It's gonna be remote journaling.
Number three,
this replication strategy guarantees zero data loss.
One, two, three.
It's gonna be synchronous replication.
Number four, of the traditional backup strategies,
this one has the fastest recovery.
Fastest recovery, one, two, three.
That's gonna be a full backup, right?
It's the slowest backup, but it's the fastest recovery.
And number five, this principle states
that resources should not be changed,
only created and destroyed.
One, two, three.
That's immutability or having immutable systems.
So let's do a security-in-action together.
This one, about data restoration.
You are responsible for backing
up data on your organization's file servers.
Now, one of the servers was severely damaged
Wednesday morning when the HVAC system malfunctioned.
Ah, you can only imagine what a mess that was.
Now, new hardware was procured
and new system files restored.
You've been instructed to restore the data.
Now, your backup strategy is full plus incremental.
You do a full backup every Sunday night.
And so the question to you is gonna be,
what versions do you need
in order to restore all your backed up files?
So let's take a look, right?
You're responsible for doing the backup
on your file servers.
One of the servers was severely damaged Wednesday morning,
you now have new hardware.
Morning, there we go.
We go Wednesday morning.
You now have new hardware, right?
And the system files are restored
and you have to restore the data.
And your backup strategy was full plus incremental
and you do a full backup on Sunday night.
So my question to you
is what do you need in order to restore
all your backup files?
Go ahead and put me on pause if you want.
Write down some notes
about what versions you need to do a perfect restore.
Well, incremental strategy backs up all files marked
as changed, and then resets the archive bit.
So to restore all backup files,
you're going to need the last full backup from Sunday night,
and then Monday night's incremental
and Tuesday night's incremental, right?
We had damage Wednesday morning,
so we assume that there is no Wednesday incremental.
So we're going to need the full backup from Sunday,
plus Monday's incremental, plus Tuesday's incremental.
And that will be the process that you'll do it in.
And then you will have all your files back hopefully,
if everything went well, on those file servers,
and being able to to do that, make this happen,
security-in-action.
Now, there's a pretty big word cloud.
Once again, take your time, go through it, make sure
that you can speak to all the terms and all the concepts,
not go right back through the lesson again.
Everything is right there for you.
And when you're ready, head on over
to the next lesson and I'll see you there.