Topics in this domain
- Event vs Incident vs Breach
- Developing the Incident Response Plan
- Incident Response Team Roles and Authority
- Incident Classification and Severity Levels
- Incident Response Playbooks and Decision Trees
- Escalation and Communication Plans
- Business Impact Analysis
- RTO, RPO, MTD and Recovery Prioritisation
- Business Continuity Planning and Strategies
- Crisis Management and Continuity Governance
- Disaster Recovery Planning
- Recovery Sites: Hot, Warm and Cold
- Backup Strategies and Cloud DR
- Incident Response Training
- Testing Plans: Tabletop, Functional and Full Interruption
- Evaluating Exercises and Improving Readiness
- Security Event Detection and Monitoring Methods
- SIEM, the SOC and Event Correlation
- Threat Intelligence and Indicators of Compromise
- Incident Triage and Initial Investigation
- Evidence Preservation, Forensics and Chain of Custody
- Containment Strategies: Short-Term and Long-Term
- Making Containment Decisions
- Breach Notification and Regulatory Reporting
- External Communications: Customers, Media and Law Enforcement
- Eradication, Recovery and Return to Normal Operations
- Post-Incident Review and Root Cause Analysis
- Lessons Learned and Incident Trend Analysis
Recovery Sites: Hot, Warm and Cold
Where do we recover?
If the primary data centre or cloud region is lost, systems need somewhere else to run. The options range from a full duplicate running all the time to an empty room with power and cooling. The RTO from the BIA decides which the organisation needs; cost decides how far it can go.
Site options
| Option | What’s there | Typical recovery | Cost |
|---|---|---|---|
| Mirrored / active-active | A full duplicate with live data | Near zero | Very high |
| Hot site / cloud standby | Fully equipped; load current data | Hours | High |
| Warm site / cloud pilot light | Some equipment; configure and restore | Hours to days | Medium |
| Cold site | Space, power, cooling only | Weeks | Low |
| Reciprocal agreement | Another organisation’s spare capacity | Uncertain | Low |
Reciprocal agreements look cheap, but they often fail on capacity (the partner is busy too), compatibility and enforceability.
Checks before relying on a site
- Distance: not exposed to the same disaster (flood plain, power grid, cloud region).
- Security: at least as strong as the primary site. A weaker recovery site becomes the easiest way in.
- Capacity: enough to meet the service delivery objective, and not oversubscribed.
- Testing: the contract gives the right to test, and tests actually happen.
Example. A bank’s commercial hot site serves 40 subscribers in the same city. In a regional flood, all would declare at once, and space goes first come, first served. The bank moves its critical systems to cloud DR in a different region instead.
Cloud as a recovery site
- Pilot light: data replicated, with minimal servers ready to scale up.
- Warm standby: a scaled-down copy running all the time.
- Multi-region active-active for the most critical services.
- Check capacity guarantees, identity and network access during a disaster, and tested runbooks.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| A site operational within hours | Hot site |
| A site with only space and power | Cold site |
| What drives the choice of site | The RTO from the BIA |
| Weakness of reciprocal agreements | Capacity, compatibility and enforceability |
| Key location requirement | Not exposed to the same regional risk |
In short
- Site choice is driven by the RTO: the shorter the RTO, the more ready (and expensive) the site.
- Mirrored sites give near-zero recovery; hot sites recover in hours; warm sites in days; cold sites in weeks.
- Cloud DR can act as a hot or warm site depending on how much is kept running, and is now a common option.
- Reciprocal agreements are cheap but often fail on capacity, compatibility and enforceability.
- Recovery sites must be far enough away to avoid the same disaster, and as secure as the primary site.
- Contracts for commercial sites cover capacity, oversubscription, testing rights, duration of use and security.
Exam traps
- A cold site can't meet a short RTO.
- A recovery site in the same flood plain or power grid can fail with the primary.
- Shared commercial sites may be oversubscribed in a regional disaster.
- A recovery site with weaker security becomes the easiest way in.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Site options
1 / 9