In this lesson,
we're going to cover availability.
Now, availability in information security is used to ensure
that information, systems and resources are accessible
and operational when needed by authorized users.
In simpler terms, availability is all
about making sure that services, systems
and data are always available when they're supposed to be.
Let's pretend for a moment
that you have an important online meeting scheduled
for 10:00 AM tomorrow but just minutes before that,
your internet connection goes down.
This would be super frustrating for you
and now you're not going to be able
to attend the meeting, right?
Well, this situation emphasizes the importance
of availability in our increasingly connected world.
Just as you'd want your internet to always be up and running
especially during critical times, in that same vein,
businesses need their systems and services
to be available around the clock
to meet their customer demands
and to maintain their brand's reputation.
When you're considering which system
or service provider to use
you're often going to hear them refer
to their availability status
by a number of nines that they can provide.
For example, three nines
of availability equates to 99.9% uptime.
This means that in a standard calendar year with 365 days,
we have 8,760 hours available.
So a system with 99.9% uptime can be down
for a maximum of 8.76 hours.
If that's too much downtime for you though,
you can actually go and find a provider
who has more nines of availability.
For example, I used to work for a service provider
that had to maintain five nines of availability.
Now, five nines is considered to be the gold standard
and this means we have to achieve a system uptime
of 99.999%.
Now, if you translate this into minutes or hours
this actually means that our system has to guarantee
that we are going to have a downtime
of no more than 5.26 minutes in any given calendar year.
Achieving this gold standard
of availability ensures that services
and applications are virtually always going
to be accessible to our users, and it minimizes disruptions
and potential revenue loss events.
To put this into perspective,
while a 99% uptime may seem high,
it still allows you to have over 3.5 days
of downtime per year, whereas the five nines
of availability slashes that down to a mere five minutes.
This level of reliability means we're going to have
to have a robust infrastructure, proactive monitoring,
redundancy measures, and swift disaster recovery mechanisms
in order to achieve five nines of availability.
Now, as cybersecurity professionals,
we do value availability
because it helps us to ensure business continuity,
to maintain our customer trust
and to uphold our organization's reputation.
Now, first, we need to talk
about ensuring business continuity.
Every minute your system is down
your business might be facing significant losses.
For an e-commerce site,
this can mean a direct loss in sales.
For a hospital, it can mean a life-threatening situation
if a critical system isn't operational.
For example, in the telecommunications industry,
a single hour of downtime can cost them
on average $2 million.
That means that for every minute of downtime,
they're losing about $33,000 per minute.
Second, we have maintaining customer trust.
Now, if customers can't access their accounts,
purchase their products or use services
because your system is down, their trust
in your company is going to go down.
If you suffer from a prolonged unavailability event,
this can actually cause your customers to look
for alternative solutions and purchase products or services
from your competitors, causing you to lose revenue.
Third and finally,
we have upholding your organization's reputation.
Now, if you have repeated downtime events,
this is not only going to affect your business operations
but also tarnishes your organization's image
in the long run.
And this will make it more challenging
to regain those customers' confidence in your organizations
if they leave you for another provider.
Now, in order to overcome the challenges associated
with maintaining high levels of availability,
the best strategy is to use redundancy
in all of your systems and network designs.
Now, redundancy is the duplication
of critical components or functions
of a system with the intention of enhancing its reliability.
In simple words, it's about having backup options
to ensure uninterrupted service.
If one of your systems fails,
the backup should take over, ensuring constant availability.
Think of it as having a spare tire in your car.
If one tire gets punctured, you're able to go out
and immediately replace it with your spare
and continue your journey without a significant delay.
For example, I used to live on the island of Puerto Rico
and down there we often faced hurricanes
and other natural disasters
that could affect our business operations.
Now, to overcome the threat of losing internet at my office
I actually had three different internet connections.
One was from a dedicated
microwave wireless service provider,
one was a connection from my local cable company
and one was provided by a cellular modem.
Now, if the microwave link went down,
then our systems automatically switched over
to the cable modem.
If the cable modem also went down,
we would switch over to the cellular modem.
This way, regardless of what kind of outage occurred,
we had redundancy in place
to maintain the continuity of our operations.
Now, there are various types
of redundancy that you need to consider
when you're designing your systems and your networks.
This includes server redundancy, data redundancy,
network redundancy, and power redundancy.
First, we have server redundancy.
Server redundancy involves using multiple servers
in a load balance or failover configuration, so that if one
of those is overloaded or fails, the other servers
can take over the load and continue to support your users.
Second, we have data redundancy.
Data redundancy involves storing data in multiple places.
This way, if one storage site fails,
the data can still be accessed from another location.
Often we achieve this locally using raids or using a hybrid
of on-premise and cloud-based backup systems.
Third, we have network redundancy.
Now, network redundancy ensures
that if one network path fails,
the data can still travel through another route.
This is how I set up my old offices in Puerto Rico so that
if the microwave link went down, we switched over to cable.
If the cable went down,
we switched over to cellular, and this way we
could continue providing network connectivity
to all of our users.
Fourth and finally, we have power redundancy.
Power redundancy involves using backup power sources,
like generators and uninterrupted power supply systems
to ensure that your organization's systems
remain operational even during periods of power disruption
or outages within your local service area.
So remember, availability is used to ensure that the data
and systems are always ready for use when they're needed.
The principle of redundancy plays a pivotal role
in guaranteeing this uninterrupted service
and achieving your higher levels of availability.
So you should associate the term availability
with redundancy because they go hand in hand.
In a world where time is money
and every second is going to count,
ensuring the constant availability
of your services is not just beneficial,
it's imperative for your organization's continued success
in this digital age.