1
00:00:06,390 --> 00:00:09,000
- Welcome to Lesson 13,
Explain the Importance

2
00:00:09,000 --> 00:00:12,810
of Resilience and Recovery
in Security Architecture.

3
00:00:12,810 --> 00:00:14,790
So in this, Lesson 13.1,

4
00:00:14,790 --> 00:00:18,753
we're really gonna focus
in on backup and recovery.

5
00:00:18,753 --> 00:00:21,540
Now, backup and recovery processes ensure

6
00:00:21,540 --> 00:00:23,490
that accurate and reliable copies

7
00:00:23,490 --> 00:00:26,010
of data and system
configurations are going

8
00:00:26,010 --> 00:00:29,280
to be created, maintained, and tested.

9
00:00:29,280 --> 00:00:30,570
Now, why do we need that?

10
00:00:30,570 --> 00:00:34,410
Because stuff breaks, stuff
fails, stuff gets corrupted,

11
00:00:34,410 --> 00:00:35,370
and we wanna make sure

12
00:00:35,370 --> 00:00:37,410
that we have those reliable copies of data

13
00:00:37,410 --> 00:00:41,373
and system configurations so
that we can quickly recover.

14
00:00:42,690 --> 00:00:44,820
Now, there are really four categories

15
00:00:44,820 --> 00:00:47,370
of backup and recovery: traditional,

16
00:00:47,370 --> 00:00:51,690
online, replication, and then automation.

17
00:00:51,690 --> 00:00:53,940
Now, traditional backup
and recovery generally

18
00:00:53,940 --> 00:00:57,333
uses removable media or
a local disk library.

19
00:00:58,410 --> 00:01:00,840
Online backup and recovery preserves data

20
00:01:00,840 --> 00:01:03,210
by creating copies of it and storing them

21
00:01:03,210 --> 00:01:06,363
either in an online or a
cloud-based environment.

22
00:01:07,230 --> 00:01:09,000
Replication is the process

23
00:01:09,000 --> 00:01:11,400
of creating and
maintaining multiple copies

24
00:01:11,400 --> 00:01:14,580
of data across different locations.

25
00:01:14,580 --> 00:01:16,560
And automation is really our approach

26
00:01:16,560 --> 00:01:19,830
to automated provisioning and replacement.

27
00:01:19,830 --> 00:01:20,663
So we're gonna go

28
00:01:20,663 --> 00:01:22,610
into each one of these
a little bit deeper.

29
00:01:24,420 --> 00:01:26,400
So traditional backup is backing

30
00:01:26,400 --> 00:01:28,530
up to removable media, tape or disk.

31
00:01:28,530 --> 00:01:31,950
So it might be from
going from disk to tape.

32
00:01:31,950 --> 00:01:33,600
It could be going disk to disk.

33
00:01:33,600 --> 00:01:35,460
It could be going disk to disk to tape.

34
00:01:35,460 --> 00:01:37,740
It could be going disk to disk to cloud.

35
00:01:37,740 --> 00:01:40,260
But regardless of kind
of where it's going,

36
00:01:40,260 --> 00:01:41,970
there's three approaches.

37
00:01:41,970 --> 00:01:44,820
There's a full backup,
there's a differential backup,

38
00:01:44,820 --> 00:01:46,680
and an incremental backup.

39
00:01:46,680 --> 00:01:49,680
A full backup is going
to back up all files.

40
00:01:49,680 --> 00:01:52,140
You give it a target, backups all files.

41
00:01:52,140 --> 00:01:54,090
A differential backup is gonna back

42
00:01:54,090 --> 00:01:55,920
up all files that have been created

43
00:01:55,920 --> 00:01:58,830
or modified since the last full backup.

44
00:01:58,830 --> 00:02:01,890
And what it doesn't do
is reset an archive bit

45
00:02:01,890 --> 00:02:04,140
and every file has an archive bit

46
00:02:04,140 --> 00:02:06,300
that, if it's being backed up, gets reset,

47
00:02:06,300 --> 00:02:09,420
but it doesn't reset the
archive bit in this case.

48
00:02:09,420 --> 00:02:12,390
An incremental backs up all change files

49
00:02:12,390 --> 00:02:14,880
but an incremental does
reset the archive bit.

50
00:02:14,880 --> 00:02:15,900
So let's go through the difference

51
00:02:15,900 --> 00:02:17,970
between differential and incremental.

52
00:02:17,970 --> 00:02:21,120
Let's say I do a full backup on Sunday.

53
00:02:21,120 --> 00:02:24,240
Monday's differential will
be what has been created

54
00:02:24,240 --> 00:02:26,160
or modified on Monday.

55
00:02:26,160 --> 00:02:28,710
Tuesday's differential
will be what was created

56
00:02:28,710 --> 00:02:31,350
or modified Monday and Tuesday.

57
00:02:31,350 --> 00:02:34,230
Wednesday's differential
will be what has been created

58
00:02:34,230 --> 00:02:36,510
or modified Monday, Tuesday, Wednesday.

59
00:02:36,510 --> 00:02:37,343
Why?

60
00:02:37,343 --> 00:02:39,090
Because that archive
bit hasn't been reset.

61
00:02:39,090 --> 00:02:39,923
The system says, oh,

62
00:02:39,923 --> 00:02:41,260
I still need to back this up.

63
00:02:42,360 --> 00:02:45,540
Incremental, now if I do
a full backup on Sunday,

64
00:02:45,540 --> 00:02:49,170
Monday's incremental is what
was created or modified Monday.

65
00:02:49,170 --> 00:02:50,340
Tuesday's incremental

66
00:02:50,340 --> 00:02:52,680
is what's been created
or modified Tuesday.

67
00:02:52,680 --> 00:02:53,670
Wednesday's incremental

68
00:02:53,670 --> 00:02:56,190
is what was created or modified Wednesday.

69
00:02:56,190 --> 00:02:57,720
What happens when I have to do a restore?

70
00:02:57,720 --> 00:03:00,060
Well, a full backup, I have a full media.

71
00:03:00,060 --> 00:03:02,280
If it's a differential,
I go to the full backup

72
00:03:02,280 --> 00:03:04,110
and the most recent differential.

73
00:03:04,110 --> 00:03:06,810
And if it's incremental,
I go to a full backup

74
00:03:06,810 --> 00:03:10,500
and then all of the subsequent
incrementals in order.

75
00:03:10,500 --> 00:03:12,210
So, you know, an incremental

76
00:03:12,210 --> 00:03:14,340
will be the fastest backup,

77
00:03:14,340 --> 00:03:16,353
but it will be the slowest recovery.

78
00:03:19,020 --> 00:03:21,090
Now, if I'm going disk to disk,

79
00:03:21,090 --> 00:03:23,250
two common options are gonna be doing it

80
00:03:23,250 --> 00:03:25,020
to a network-attached storage device,

81
00:03:25,020 --> 00:03:29,370
known as a NAS or a storage
area network, known as a SAN.

82
00:03:29,370 --> 00:03:32,220
Now, a NAS is just a file
dedicated storage device.

83
00:03:32,220 --> 00:03:33,870
It connects over Ethernet.

84
00:03:33,870 --> 00:03:38,070
It is relatively inexpensive
to add additional storage,

85
00:03:38,070 --> 00:03:40,143
additional NAS devices as you grow.

86
00:03:41,040 --> 00:03:43,230
A SAN is a specialized high speed

87
00:03:43,230 --> 00:03:44,760
fiber channel network

88
00:03:44,760 --> 00:03:47,910
that provides network
access to storage devices.

89
00:03:47,910 --> 00:03:50,730
Now, SANs create an image by
mirroring a production disk

90
00:03:50,730 --> 00:03:53,373
to another disk inside a storage array.

91
00:03:56,490 --> 00:03:57,323
Now, there are a number

92
00:03:57,323 --> 00:04:00,390
of different online backup
strategies available to us.

93
00:04:00,390 --> 00:04:02,130
One is we could back
up right to the cloud,

94
00:04:02,130 --> 00:04:04,320
right, schedule backup
to a cloud location,

95
00:04:04,320 --> 00:04:06,093
or to a cloud backup service.

96
00:04:07,020 --> 00:04:09,270
We have an option of disk shadowing.

97
00:04:09,270 --> 00:04:11,670
In disk shadowing, data
is going to be written

98
00:04:11,670 --> 00:04:15,000
to and read from to or
more independent disks

99
00:04:15,000 --> 00:04:18,000
and the process is
transparent to the user.

100
00:04:18,000 --> 00:04:19,620
We're gonna be talking a little bit more

101
00:04:19,620 --> 00:04:22,590
about disk shadowing
when we talk about RAID.

102
00:04:22,590 --> 00:04:24,690
And we have electronic vaulting.

103
00:04:24,690 --> 00:04:28,140
Electronic vaulting copies
files as they change

104
00:04:28,140 --> 00:04:30,300
and then periodically transmits them

105
00:04:30,300 --> 00:04:35,280
to a secure backup location,
and remote journaling copies

106
00:04:35,280 --> 00:04:38,640
and periodically
transmits transaction logs

107
00:04:38,640 --> 00:04:40,380
to a backup location.

108
00:04:40,380 --> 00:04:42,300
So just different strategies, right,

109
00:04:42,300 --> 00:04:46,353
to accomplish having, you
know, good valid copies.

110
00:04:48,690 --> 00:04:50,100
Let's talk about replication.

111
00:04:50,100 --> 00:04:53,850
There are three primary
approaches to replication:

112
00:04:53,850 --> 00:04:58,200
point in time, asynchronous
replication, and synchronous.

113
00:04:58,200 --> 00:05:01,620
In a point in time replication,
periodic snapshots are taken

114
00:05:01,620 --> 00:05:04,650
and replicated, and if the
snapshots are pointer-based,

115
00:05:04,650 --> 00:05:06,723
just the changes are transmitted.

116
00:05:07,680 --> 00:05:10,740
Asynchronous replication
is an automated process

117
00:05:10,740 --> 00:05:11,850
that streams copies

118
00:05:11,850 --> 00:05:15,480
of the data to the second location, right?

119
00:05:15,480 --> 00:05:17,460
And the write is
considered complete as soon

120
00:05:17,460 --> 00:05:19,440
as the local storage commits.

121
00:05:19,440 --> 00:05:21,240
So remote storage is gonna be updated

122
00:05:21,240 --> 00:05:23,223
with just a slight time lag.

123
00:05:24,120 --> 00:05:26,790
Where synchronous replication
is an automated process

124
00:05:26,790 --> 00:05:28,260
that streams copies of data

125
00:05:28,260 --> 00:05:30,420
and both write operations, right,

126
00:05:30,420 --> 00:05:33,690
the local and the remote,
must successfully complete

127
00:05:33,690 --> 00:05:35,730
before the system can proceed.

128
00:05:35,730 --> 00:05:37,440
Because our goal with synchronous

129
00:05:37,440 --> 00:05:39,753
is guaranteed zero data loss.

130
00:05:42,150 --> 00:05:44,220
Next up, we have automation strategies.

131
00:05:44,220 --> 00:05:47,160
And automation strategies
are most often used

132
00:05:47,160 --> 00:05:49,350
when we're talking about
configuration files

133
00:05:49,350 --> 00:05:51,690
for a system or device.

134
00:05:51,690 --> 00:05:54,540
Infrastructure-as-code
and immutable system.

135
00:05:54,540 --> 00:05:56,640
Now, you've learned about
both of these already.

136
00:05:56,640 --> 00:05:58,500
So this is really a review.

137
00:05:58,500 --> 00:06:01,110
Infrastructure-as-code uses code

138
00:06:01,110 --> 00:06:04,320
or configuration files
to manage configurations

139
00:06:04,320 --> 00:06:07,710
and automate the provisioning
of infrastructure.

140
00:06:07,710 --> 00:06:09,810
Now, infrastructure-as-code
actually solves the problem

141
00:06:09,810 --> 00:06:10,890
of configuration drift.

142
00:06:10,890 --> 00:06:12,570
So what's configuration drift?

143
00:06:12,570 --> 00:06:14,520
Configuration drift is when our primary

144
00:06:14,520 --> 00:06:17,640
and our backup systems
over time just change a lot

145
00:06:17,640 --> 00:06:20,610
because we've made changes
in one, but not in the other.

146
00:06:20,610 --> 00:06:22,770
And by using these configuration files,

147
00:06:22,770 --> 00:06:25,070
we can make sure that
they're staying in sync.

148
00:06:26,100 --> 00:06:27,780
Now, immutability, again, we've already

149
00:06:27,780 --> 00:06:28,860
talked about this one,

150
00:06:28,860 --> 00:06:32,280
is the principle that resources
should not be changed,

151
00:06:32,280 --> 00:06:34,080
only created and destroyed.

152
00:06:34,080 --> 00:06:35,850
So for example, using an image

153
00:06:35,850 --> 00:06:39,450
of a system preconfigured to
a desired known good state.

154
00:06:39,450 --> 00:06:41,580
What we're really doing
here is using automation

155
00:06:41,580 --> 00:06:44,223
to replace rather than to fix.

156
00:06:46,770 --> 00:06:47,603
We need to think

157
00:06:47,603 --> 00:06:49,680
about the inverse
relationship between the cost

158
00:06:49,680 --> 00:06:52,770
of disruption and the
cost to recover, right?

159
00:06:52,770 --> 00:06:56,670
And try to find the best balance
point for our organization.

160
00:06:56,670 --> 00:06:59,730
You know, generally, again,
there's an inverse relationship.

161
00:06:59,730 --> 00:07:01,710
The cost of disruption

162
00:07:01,710 --> 00:07:04,803
and the cost to recover,
right, are going to cross.

163
00:07:05,820 --> 00:07:07,290
This actually is a really interesting

164
00:07:07,290 --> 00:07:09,270
little graphic and it comes

165
00:07:09,270 --> 00:07:12,390
from National Institute of
Standards in Technology.

166
00:07:12,390 --> 00:07:17,130
SP800 Special Publication, 800-34r1.

167
00:07:19,020 --> 00:07:22,950
So how do you make a decision
about what type of backup?

168
00:07:22,950 --> 00:07:24,690
You have all these options, right?

169
00:07:24,690 --> 00:07:26,520
How are you gonna make a decision?

170
00:07:26,520 --> 00:07:28,320
Well, again, we're gonna
strategically align

171
00:07:28,320 --> 00:07:29,880
with the needs of the organization.

172
00:07:29,880 --> 00:07:32,340
And we are going to
take into consideration

173
00:07:32,340 --> 00:07:36,150
cost versus complexity
versus availability.

174
00:07:36,150 --> 00:07:39,180
So we have traditional
recovery, enhanced recovery,

175
00:07:39,180 --> 00:07:42,810
rapid recovery, and continuous
availability, right?

176
00:07:42,810 --> 00:07:44,760
Our traditional recovery
being tape backup,

177
00:07:44,760 --> 00:07:46,560
low complexity, low cost,

178
00:07:46,560 --> 00:07:49,380
but our recovery is
measured in hours to days.

179
00:07:49,380 --> 00:07:50,520
Our enhanced recovery,

180
00:07:50,520 --> 00:07:53,640
our automated solutions,
medium complexity,

181
00:07:53,640 --> 00:07:58,200
fairly low cost still, recovery
is measured in hours to days

182
00:07:58,200 --> 00:08:00,990
but we might have more recoverable data.

183
00:08:00,990 --> 00:08:04,410
Rapid recovery is looking
at asynchronous replication,

184
00:08:04,410 --> 00:08:07,350
higher complexity, more moderate cost,

185
00:08:07,350 --> 00:08:10,620
but recovery now is measured
in minutes to hours.

186
00:08:10,620 --> 00:08:13,650
And lastly, we have
continuous availability.

187
00:08:13,650 --> 00:08:16,860
So that's synchronous
replication or automation,

188
00:08:16,860 --> 00:08:18,930
high complexity, high cost,

189
00:08:18,930 --> 00:08:22,110
but our recovery is measured in seconds.

190
00:08:22,110 --> 00:08:24,540
So we really need to decide what we need

191
00:08:24,540 --> 00:08:26,790
based on the needs of the organization.

192
00:08:26,790 --> 00:08:29,130
And it doesn't have to
be a one-size-fits-all.

193
00:08:29,130 --> 00:08:30,720
We may do traditional recovery

194
00:08:30,720 --> 00:08:33,210
for some data and configuration files.

195
00:08:33,210 --> 00:08:36,690
We may do continuous
availability for others, right?

196
00:08:36,690 --> 00:08:37,920
So it's really important

197
00:08:37,920 --> 00:08:40,470
that we look at our enterprise and say

198
00:08:40,470 --> 00:08:43,230
what is going to strategically
align with the needs

199
00:08:43,230 --> 00:08:46,380
of our organization in terms
of backup and recovery,

200
00:08:46,380 --> 00:08:47,880
taking into consideration

201
00:08:47,880 --> 00:08:51,033
cost versus complexity
versus availability.

202
00:08:52,290 --> 00:08:54,510
That, my friends, brings us
to a three-second challenge.

203
00:08:54,510 --> 00:08:57,030
Five challenge questions,
three seconds each.

204
00:08:57,030 --> 00:08:59,010
You know how to do this.

205
00:08:59,010 --> 00:09:01,170
This backup strategy backs up all files

206
00:09:01,170 --> 00:09:04,710
created or modified since
the last full backup.

207
00:09:04,710 --> 00:09:06,873
One, two, three.

208
00:09:08,154 --> 00:09:09,090
It's gonna be a differential.

209
00:09:09,090 --> 00:09:10,920
So everything that's different,
think of it that way,

210
00:09:10,920 --> 00:09:14,100
everything that's different
from the last backup.

211
00:09:14,100 --> 00:09:17,400
Number two, this process
copies transaction change logs

212
00:09:17,400 --> 00:09:20,853
and periodically transmits
them to a backup location.

213
00:09:21,900 --> 00:09:23,553
One, two, three.

214
00:09:24,510 --> 00:09:26,110
It's gonna be remote journaling.

215
00:09:27,900 --> 00:09:28,920
Number three,

216
00:09:28,920 --> 00:09:32,313
this replication strategy
guarantees zero data loss.

217
00:09:33,270 --> 00:09:35,283
One, two, three.

218
00:09:36,330 --> 00:09:39,090
It's gonna be synchronous replication.

219
00:09:39,090 --> 00:09:41,880
Number four, of the
traditional backup strategies,

220
00:09:41,880 --> 00:09:44,580
this one has the fastest recovery.

221
00:09:44,580 --> 00:09:48,660
Fastest recovery, one, two, three.

222
00:09:48,660 --> 00:09:50,430
That's gonna be a full backup, right?

223
00:09:50,430 --> 00:09:54,333
It's the slowest backup, but
it's the fastest recovery.

224
00:09:57,120 --> 00:09:59,490
And number five, this principle states

225
00:09:59,490 --> 00:10:01,770
that resources should not be changed,

226
00:10:01,770 --> 00:10:03,843
only created and destroyed.

227
00:10:05,010 --> 00:10:07,290
One, two, three.

228
00:10:07,290 --> 00:10:10,860
That's immutability or
having immutable systems.

229
00:10:10,860 --> 00:10:12,780
So let's do a security-in-action together.

230
00:10:12,780 --> 00:10:15,090
This one, about data restoration.

231
00:10:15,090 --> 00:10:16,410
You are responsible for backing

232
00:10:16,410 --> 00:10:19,110
up data on your
organization's file servers.

233
00:10:19,110 --> 00:10:21,570
Now, one of the servers
was severely damaged

234
00:10:21,570 --> 00:10:25,470
Wednesday morning when the
HVAC system malfunctioned.

235
00:10:25,470 --> 00:10:27,600
Ah, you can only imagine
what a mess that was.

236
00:10:27,600 --> 00:10:29,160
Now, new hardware was procured

237
00:10:29,160 --> 00:10:31,800
and new system files restored.

238
00:10:31,800 --> 00:10:33,990
You've been instructed
to restore the data.

239
00:10:33,990 --> 00:10:38,040
Now, your backup strategy
is full plus incremental.

240
00:10:38,040 --> 00:10:41,070
You do a full backup every Sunday night.

241
00:10:41,070 --> 00:10:42,900
And so the question to you is gonna be,

242
00:10:42,900 --> 00:10:44,370
what versions do you need

243
00:10:44,370 --> 00:10:47,880
in order to restore all
your backed up files?

244
00:10:47,880 --> 00:10:49,140
So let's take a look, right?

245
00:10:49,140 --> 00:10:51,000
You're responsible for doing the backup

246
00:10:51,000 --> 00:10:52,800
on your file servers.

247
00:10:52,800 --> 00:10:57,420
One of the servers was severely
damaged Wednesday morning,

248
00:10:57,420 --> 00:10:58,953
you now have new hardware.

249
00:11:00,360 --> 00:11:01,193
Morning, there we go.

250
00:11:01,193 --> 00:11:02,700
We go Wednesday morning.

251
00:11:02,700 --> 00:11:04,650
You now have new hardware, right?

252
00:11:04,650 --> 00:11:06,270
And the system files are restored

253
00:11:06,270 --> 00:11:08,850
and you have to restore the data.

254
00:11:08,850 --> 00:11:13,050
And your backup strategy
was full plus incremental

255
00:11:13,050 --> 00:11:15,483
and you do a full backup on Sunday night.

256
00:11:17,100 --> 00:11:18,630
So my question to you

257
00:11:18,630 --> 00:11:22,230
is what do you need in order to restore

258
00:11:22,230 --> 00:11:23,670
all your backup files?

259
00:11:23,670 --> 00:11:25,590
Go ahead and put me on pause if you want.

260
00:11:25,590 --> 00:11:26,490
Write down some notes

261
00:11:26,490 --> 00:11:30,033
about what versions you need
to do a perfect restore.

262
00:11:32,460 --> 00:11:35,160
Well, incremental strategy
backs up all files marked

263
00:11:35,160 --> 00:11:38,820
as changed, and then
resets the archive bit.

264
00:11:38,820 --> 00:11:41,160
So to restore all backup files,

265
00:11:41,160 --> 00:11:44,760
you're going to need the last
full backup from Sunday night,

266
00:11:44,760 --> 00:11:46,950
and then Monday night's incremental

267
00:11:46,950 --> 00:11:49,560
and Tuesday night's incremental, right?

268
00:11:49,560 --> 00:11:50,820
We had damage Wednesday morning,

269
00:11:50,820 --> 00:11:54,000
so we assume that there is
no Wednesday incremental.

270
00:11:54,000 --> 00:11:56,760
So we're going to need the
full backup from Sunday,

271
00:11:56,760 --> 00:11:59,970
plus Monday's incremental,
plus Tuesday's incremental.

272
00:11:59,970 --> 00:12:02,040
And that will be the process
that you'll do it in.

273
00:12:02,040 --> 00:12:05,010
And then you will have all
your files back hopefully,

274
00:12:05,010 --> 00:12:08,070
if everything went well,
on those file servers,

275
00:12:08,070 --> 00:12:10,680
and being able to to do
that, make this happen,

276
00:12:10,680 --> 00:12:11,913
security-in-action.

277
00:12:13,440 --> 00:12:14,670
Now, there's a pretty big word cloud.

278
00:12:14,670 --> 00:12:17,250
Once again, take your time,
go through it, make sure

279
00:12:17,250 --> 00:12:19,770
that you can speak to all the
terms and all the concepts,

280
00:12:19,770 --> 00:12:21,450
not go right back
through the lesson again.

281
00:12:21,450 --> 00:12:23,220
Everything is right there for you.

282
00:12:23,220 --> 00:12:24,420
And when you're ready, head on over

283
00:12:24,420 --> 00:12:26,520
to the next lesson and I'll see you there.