Incident Response and Disaster Recovery
The incident response lifecycle
- Preparation — plan, team, tooling, and training in place before anything happens.
- Detection and identification — is this actually an incident?
- Containment — stop the bleeding; short-term then long-term.
- Eradication — remove the root cause, not just the symptom.
- Recovery — restore to known-good and monitor closely.
- Lessons learned — feed findings back into preparation.
Recovery sites and strategies
- Hot site — fully equipped and running; hours to activate, most expensive.
- Warm site — hardware and connectivity but no current data; days to activate.
- Cold site — space and power only; weeks to activate, cheapest.
- Reciprocal agreements and mobile sites are alternatives with their own risks.
- Backups: full, incremental (fastest backup, slowest restore), and differential (slower backup, faster restore).
RAID provides fault tolerance, not backup. RAID 1 mirrors, RAID 5 stripes with distributed parity and survives one disk failure, and RAID 0 provides no redundancy at all. Clustering and load balancing address availability at the service level.
Exam tip
Restoration order matters: bring the least critical systems back first to verify the environment is safe, and restore the most critical functions to the primary site last. And always, first, protect human life.