WEBVTT

1
00:00:00.000 --> 00:00:01.020
In this lesson,

2
00:00:01.020 --> 00:00:04.620
we will learn about Availability Risk Considerations.

3
00:00:04.620 --> 00:00:06.810
Availability Risk Considerations

4
00:00:06.810 --> 00:00:09.790
ensure that critical systems and data remain accessible

5
00:00:09.790 --> 00:00:13.170
during and after disruptive events.

6
00:00:13.170 --> 00:00:15.455
Availability risk considerations include

7
00:00:15.455 --> 00:00:18.930
Business Continuity and Disaster Recovery Planning,

8
00:00:18.930 --> 00:00:21.589
Connected Backups, Disconnected Backups,

9
00:00:21.589 --> 00:00:26.040
and Business and Continuity and Disaster Recovery Testing.

10
00:00:26.040 --> 00:00:27.930
To better understand these concepts

11
00:00:27.930 --> 00:00:30.180
and the relationships to one another,

12
00:00:30.180 --> 00:00:31.680
let's think about a fictional

13
00:00:31.680 --> 00:00:33.990
global financial services company

14
00:00:33.990 --> 00:00:36.210
called EverTrust Financial.

15
00:00:36.210 --> 00:00:39.020
EverTrust Financial processes billions of dollars

16
00:00:39.020 --> 00:00:40.417
in daily transactions,

17
00:00:40.417 --> 00:00:44.148
and relies on robust availability risk considerations

18
00:00:44.148 --> 00:00:46.739
to ensure continuous business operation.

19
00:00:46.739 --> 00:00:50.160
To maintain availability during disruption,

20
00:00:50.160 --> 00:00:53.250
the company has developed a detailed Business Continuity

21
00:00:53.250 --> 00:00:56.699
and Disaster Recovery, or BC/DR plans.

22
00:00:56.699 --> 00:00:59.250
EverTrust Financial's business continuity

23
00:00:59.250 --> 00:01:01.440
and disaster Recovery plans include

24
00:01:01.440 --> 00:01:03.390
alternate operation sites,

25
00:01:03.390 --> 00:01:06.150
recovery workflows for critical services,

26
00:01:06.150 --> 00:01:09.000
and the restoration of data during crises,

27
00:01:09.000 --> 00:01:12.180
such as natural disasters or system failures.

28
00:01:12.180 --> 00:01:16.009
Day to day, EverTrust Financial utilizes connected backups

29
00:01:16.009 --> 00:01:18.286
that mirror real-time transaction data

30
00:01:18.286 --> 00:01:20.628
to multiple data centers.

31
00:01:20.628 --> 00:01:22.980
These connected backups ensure

32
00:01:22.980 --> 00:01:25.587
that in the event of an outage at one location,

33
00:01:25.587 --> 00:01:29.820
transactions can seamlessly continue at another.

34
00:01:29.820 --> 00:01:32.785
But, since connected backups are potentially within reach

35
00:01:32.785 --> 00:01:37.077
of a ransomware attack, EverTrust Financial also maintains

36
00:01:37.077 --> 00:01:40.650
disconnected backups stored offline.

37
00:01:40.650 --> 00:01:42.548
These disconnected backups are vital

38
00:01:42.548 --> 00:01:44.923
to restoring clean, unaltered data

39
00:01:44.923 --> 00:01:48.510
if their production systems are compromised.

40
00:01:48.510 --> 00:01:51.090
Finally, EverTrust Financial conducts

41
00:01:51.090 --> 00:01:54.900
regular business continuity and disaster recovery testing

42
00:01:54.900 --> 00:01:56.926
by simulating real-world disruptions

43
00:01:56.926 --> 00:01:59.310
to identify vulnerabilities

44
00:01:59.310 --> 00:02:01.380
and ensure that recovery procedures

45
00:02:01.380 --> 00:02:03.750
are effective and efficient.

46
00:02:03.750 --> 00:02:05.557
After all, if they don't practice it,

47
00:02:05.557 --> 00:02:07.373
it's not going to work.

48
00:02:07.373 --> 00:02:09.847
These real-world disaster simulations

49
00:02:09.847 --> 00:02:11.809
minimize real-world downtime

50
00:02:11.809 --> 00:02:16.320
to safeguard the company's reputation and customer trust.

51
00:02:16.320 --> 00:02:17.760
Now, let's explore

52
00:02:17.760 --> 00:02:19.883
each of these availability risk considerations

53
00:02:19.883 --> 00:02:21.900
in more detail.

54
00:02:21.900 --> 00:02:25.287
First, we have Business Continuity and Disaster Recovery,

55
00:02:25.287 --> 00:02:27.960
or BC/DR Planning.

56
00:02:27.960 --> 00:02:30.780
Business continuity and disaster recovery planning

57
00:02:30.780 --> 00:02:34.710
begins with a Business Impact Analysis, or BIA.

58
00:02:34.710 --> 00:02:37.732
Business Impact Analysis is a process that identifies

59
00:02:37.732 --> 00:02:41.490
and evaluates the effects of an organization

60
00:02:41.490 --> 00:02:43.410
not being able to maintain

61
00:02:43.410 --> 00:02:46.860
their Mission-Essential Functions, or MEFs.

62
00:02:46.860 --> 00:02:48.210
Mission-Essential Functions

63
00:02:48.210 --> 00:02:50.490
are the business' core activities,

64
00:02:50.490 --> 00:02:54.120
which are necessary to fulfill its strategic mission.

65
00:02:54.120 --> 00:02:56.220
Each Mission-Essential Function relies

66
00:02:56.220 --> 00:02:59.460
on specific critical assets for support.

67
00:02:59.460 --> 00:03:02.430
Critical assets include systems, data,

68
00:03:02.430 --> 00:03:04.811
and processes that must remain operational

69
00:03:04.811 --> 00:03:07.260
during a disruption.

70
00:03:07.260 --> 00:03:09.570
Once critical assets are defined,

71
00:03:09.570 --> 00:03:10.972
organizations develop strategies

72
00:03:10.972 --> 00:03:13.948
to protect and maintain their critical assets

73
00:03:13.948 --> 00:03:17.610
in support of their Mission-Essential Functions.

74
00:03:17.610 --> 00:03:19.648
Disasters that are typically planned for

75
00:03:19.648 --> 00:03:23.610
include natural disasters, cyberattacks,

76
00:03:23.610 --> 00:03:26.370
power outages, and pandemics.

77
00:03:26.370 --> 00:03:28.860
For example, EverTrust Financial's

78
00:03:28.860 --> 00:03:32.460
detailed business continuity and disaster recovery plans

79
00:03:32.460 --> 00:03:33.967
will save them time and energy

80
00:03:33.967 --> 00:03:36.769
in the immediate aftermath of a disaster

81
00:03:36.769 --> 00:03:40.580
and help them return to normalcy more quickly.

82
00:03:40.580 --> 00:03:42.995
A key aspect of business continuity

83
00:03:42.995 --> 00:03:46.613
and disaster recovery planning is identifying backup sites

84
00:03:46.613 --> 00:03:48.960
where systems can be restored to

85
00:03:48.960 --> 00:03:52.740
in the event a primary location is not functional.

86
00:03:52.740 --> 00:03:56.594
Backup site types include hot sites, warm sites,

87
00:03:56.594 --> 00:04:00.000
cold sites, and cloud sites.

88
00:04:00.000 --> 00:04:04.114
A Hot Site is a fully operational real-time backup location

89
00:04:04.114 --> 00:04:06.647
where critical systems and production data

90
00:04:06.647 --> 00:04:09.060
are continuously mirrored.

91
00:04:09.060 --> 00:04:11.580
Hot Sites allow for immediate failover

92
00:04:11.580 --> 00:04:13.564
if the primary site fails.

93
00:04:13.564 --> 00:04:16.756
Some military organizations provide critical support

94
00:04:16.756 --> 00:04:19.110
to the national infrastructure,

95
00:04:19.110 --> 00:04:21.660
and there is no tolerance for downtime.

96
00:04:21.660 --> 00:04:24.216
Because of this, several hot sites may be staffed

97
00:04:24.216 --> 00:04:28.680
and ready to take over that primary mission at any time.

98
00:04:28.680 --> 00:04:32.520
Next, a Warm Site has technical infrastructure in place,

99
00:04:32.520 --> 00:04:37.080
but requires data restoration to become fully operational.

100
00:04:37.080 --> 00:04:41.700
So, a Hot Site and a Warm Site might look exactly the same,

101
00:04:41.700 --> 00:04:44.574
but a Warm Site does not have an up-to-date copy

102
00:04:44.574 --> 00:04:46.500
of production data.

103
00:04:46.500 --> 00:04:48.120
A Cold Site, on the other hand,

104
00:04:48.120 --> 00:04:51.749
may offer only basic infrastructure like power and cooling.

105
00:04:51.749 --> 00:04:55.932
In the end, a Cold Site is a designated location to rebuild

106
00:04:55.932 --> 00:04:58.898
and may be nothing more than a lease for a site

107
00:04:58.898 --> 00:05:03.510
where an organization can rebuild following a disaster.

108
00:05:03.510 --> 00:05:06.537
Last, a Cloud Site uses cloud-based services

109
00:05:06.537 --> 00:05:09.300
to store data and applications,

110
00:05:09.300 --> 00:05:13.590
providing flexibility and scalability in disaster recovery.

111
00:05:13.590 --> 00:05:15.583
Cloud Sites often combine elements

112
00:05:15.583 --> 00:05:18.851
of hot and warm sites, due to the high availability

113
00:05:18.851 --> 00:05:21.510
and accessibility of the cloud.

114
00:05:21.510 --> 00:05:24.855
For example, EverTrust Financial's connected backups

115
00:05:24.855 --> 00:05:28.200
that mirrored real-time transaction data

116
00:05:28.200 --> 00:05:31.950
would allow them to get back into business very quickly.

117
00:05:31.950 --> 00:05:34.710
Second, we have connected backups.

118
00:05:34.710 --> 00:05:38.310
Connected backups are connected to the production network.

119
00:05:38.310 --> 00:05:41.460
Connected backups can be configured in two ways,

120
00:05:41.460 --> 00:05:44.070
synchronous and asynchronous.

121
00:05:44.070 --> 00:05:46.542
Synchronous backups copy data in real time,

122
00:05:46.542 --> 00:05:50.044
ensuring that every change made on the primary system

123
00:05:50.044 --> 00:05:52.800
is instantly mirrored to the backup.

124
00:05:52.800 --> 00:05:55.388
Real-time mirroring makes connected backups ideal

125
00:05:55.388 --> 00:05:57.840
for supporting hot sites,

126
00:05:57.840 --> 00:05:59.814
however, synchronous backups require

127
00:05:59.814 --> 00:06:04.350
high-speed network connections and can be very costly.

128
00:06:04.350 --> 00:06:06.920
So, asynchronous backups may be employed

129
00:06:06.920 --> 00:06:10.440
to transmit backup data with a slight delay,

130
00:06:10.440 --> 00:06:11.815
allowing changes to accumulate

131
00:06:11.815 --> 00:06:15.030
before being sent to the backup system.

132
00:06:15.030 --> 00:06:18.150
Asynchronous backups are useful for supporting warm sites,

133
00:06:18.150 --> 00:06:20.910
where real-time updates are not required,

134
00:06:20.910 --> 00:06:23.760
but timely recovery is still important.

135
00:06:23.760 --> 00:06:27.360
For example, EverTrust Financial's mirrored backups

136
00:06:27.360 --> 00:06:30.451
supported their hot sites and minimized the amount of data

137
00:06:30.451 --> 00:06:33.630
that they would lose in the event of a disaster,

138
00:06:33.630 --> 00:06:36.093
helping them get back to serving their customers

139
00:06:36.093 --> 00:06:38.130
as quickly as possible.

140
00:06:38.130 --> 00:06:40.687
Third, we have Disconnected Backups.

141
00:06:40.687 --> 00:06:43.705
Disconnected Backups are not continuously connected

142
00:06:43.705 --> 00:06:46.050
to the production network.

143
00:06:46.050 --> 00:06:48.699
Disconnected Backups remain unaffected by attacks

144
00:06:48.699 --> 00:06:51.270
that target the production network.

145
00:06:51.270 --> 00:06:52.664
A common backup strategy

146
00:06:52.664 --> 00:06:54.903
that includes a disconnected backup

147
00:06:54.903 --> 00:06:57.639
is the 3-2-1 Rule for backups.

148
00:06:57.639 --> 00:07:01.580
The 3-2-1 Rule advises organizations to keep three copies

149
00:07:01.580 --> 00:07:05.670
of their data over two different storage media types

150
00:07:05.670 --> 00:07:08.307
with one copy being stored off-site.

151
00:07:08.307 --> 00:07:10.980
This off-site disconnected backup

152
00:07:10.980 --> 00:07:14.925
ensures that even if local systems fail or are compromised,

153
00:07:14.925 --> 00:07:19.925
a clean and untouched copy of the data remains accessible.

154
00:07:19.980 --> 00:07:24.060
For example, while EverTrust Financial's mirrored backups

155
00:07:24.060 --> 00:07:26.670
could allow them to quickly recover their data,

156
00:07:26.670 --> 00:07:28.245
their Disconnected Backup plans

157
00:07:28.245 --> 00:07:31.370
provided assurance that the data hadn't been altered

158
00:07:31.370 --> 00:07:34.530
and that they were restoring clean data.

159
00:07:34.530 --> 00:07:35.604
Fourth and last,

160
00:07:35.604 --> 00:07:39.840
we have Business Continuity and Disaster Recovery Testing.

161
00:07:39.840 --> 00:07:41.645
Testing is essential to ensure

162
00:07:41.645 --> 00:07:44.666
that recovery strategies can be effectively implemented

163
00:07:44.666 --> 00:07:47.160
during a real disaster.

164
00:07:47.160 --> 00:07:48.940
Testing involves conducting simulations

165
00:07:48.940 --> 00:07:51.281
to verify whether critical operations

166
00:07:51.281 --> 00:07:55.530
can continue seamlessly in the event of a disruption.

167
00:07:55.530 --> 00:07:58.740
For example, an organization may test its ability

168
00:07:58.740 --> 00:08:01.414
to shift operations to a backup data center

169
00:08:01.414 --> 00:08:03.370
or alternate office location

170
00:08:03.370 --> 00:08:06.570
if the primary site becomes unavailable.

171
00:08:06.570 --> 00:08:09.342
These tests help identify any gaps in their plan,

172
00:08:09.342 --> 00:08:11.790
such as communication breakdowns,

173
00:08:11.790 --> 00:08:15.330
equipment issues, or resource shortages.

174
00:08:15.330 --> 00:08:18.510
Testing also ensures that employees know their roles

175
00:08:18.510 --> 00:08:21.004
during a crisis, thereby minimizing downtime,

176
00:08:21.004 --> 00:08:23.144
and maintaining the availability

177
00:08:23.144 --> 00:08:25.890
of mission-essential functions.

178
00:08:25.890 --> 00:08:27.510
By testing their systems,

179
00:08:27.510 --> 00:08:30.120
EverTrust was able to have the confidence

180
00:08:30.120 --> 00:08:33.300
that they would be able to provide near-continuous service

181
00:08:33.300 --> 00:08:37.500
to their customers even if a disaster were to occur.

182
00:08:37.500 --> 00:08:40.858
So, remember, Availability Risk Considerations

183
00:08:40.858 --> 00:08:44.340
ensure that critical systems and data remain accessible

184
00:08:44.340 --> 00:08:47.700
during and after disruptive events.

185
00:08:47.700 --> 00:08:50.760
Considerations include Business Continuity

186
00:08:50.760 --> 00:08:54.025
and Disaster Recovery Planning, Connected Backups,

187
00:08:54.025 --> 00:08:57.076
Disconnected Backups, and Business Continuity

188
00:08:57.076 --> 00:08:59.670
and Disaster Recovery Testing.

189
00:08:59.670 --> 00:09:02.109
Business Continuity and Disaster Recovery Planning

190
00:09:02.109 --> 00:09:04.196
identifies critical systems,

191
00:09:04.196 --> 00:09:07.817
data and processes that support mission-essential functions

192
00:09:07.817 --> 00:09:12.120
so that strategies to protect those assets can be developed.

193
00:09:12.120 --> 00:09:15.510
Connected Backups, which may be synchronous or asynchronous,

194
00:09:15.510 --> 00:09:18.002
are connected to the enterprise network.

195
00:09:18.002 --> 00:09:20.678
Disconnected Backups, such as off-site storage

196
00:09:20.678 --> 00:09:23.460
provide an additional layer of protection

197
00:09:23.460 --> 00:09:24.600
against cyber threats,

198
00:09:24.600 --> 00:09:27.570
and are not connected to the enterprise network.

199
00:09:27.570 --> 00:09:29.679
Finally, regular business continuity

200
00:09:29.679 --> 00:09:31.303
and disaster recovery testing

201
00:09:31.303 --> 00:09:34.378
verifies that recovery plans work effectively,

202
00:09:34.378 --> 00:09:37.473
ensuring systems can continue to operate smoothly

203
00:09:37.473 --> 00:09:39.633
during a disruption.