Security Operations · Topic 7 of 9
Recovery Strategies
Backup storage strategies, recovery site types from cold to hot, cloud recovery patterns, multiple processing sites, and resilience with HA, QoS and fault tolerance.
- 4 min
- Includes a diagram
- Full, incremental and differential trade backup speed against restore speed.
- Keep an immutable, separately managed backup copy.
- Cold, warm, hot, mirrored: faster recovery costs more.
What it is
Recovery strategies are the means of restoring operations after a disruption: backups, alternate sites, redundant systems and resilient designs. They are chosen to meet the RTO and RPO set in the business impact analysis at a cost the business accepts.
How it works
Backup types
| Type | Backs up | Restore needs |
|---|---|---|
| Full | Everything | The full backup only |
| Incremental | Changes since the last backup of any type | Last full plus every incremental since |
| Differential | Changes since the last full backup | Last full plus the latest differential |
Incrementals are fastest to make and slowest to restore; differentials grow each day but restore faster.
Backup storage strategies
- Follow a 3-2-1 style approach: several copies, on different media or platforms, with at least one offsite.
- Keep at least one immutable or offline copy managed with credentials separate from the production domain, so ransomware cannot destroy it.
- Back up configurations and encryption keys as well as data, and test full restores of applications, not only databases.
- Use electronic vaulting (bulk transfer offsite) or remote journaling (transaction logs sent offsite) when RPO is short.
Recovery site types
| Site | Ready state | Recovery time | Cost |
|---|---|---|---|
| Cold site | Space, power and environmental controls; no installed equipment | Days to weeks | Lowest |
| Warm site | Some equipment installed; data restored from backup | Hours to a day or so | Medium |
| Hot site | Fully equipped with current data | Minutes to hours | High |
| Mirrored / redundant site | Runs in parallel with production | Near zero | Highest |
| Mobile site | Transportable units | Varies | Varies |
| Reciprocal agreement | Another organization hosts you | Uncertain | Low, but capacity and fit are unreliable |
Match the site to the RTO and budget. A 24-hour recovery with pre-installed equipment and data restored from backup describes a warm site.
Cloud recovery patterns
| Pattern | Description |
|---|---|
| Backup and restore | Nothing running; rebuild from backups |
| Pilot light | A minimal core (such as the database) runs; the rest scales out at failover |
| Warm standby | A scaled-down but complete copy runs |
| Multi-site active-active | Full capacity in several sites at all times |
Multiple processing sites and geography
Recovery sites must not share the same risks as the primary: separate utilities, carriers and hazard zones. Synchronous replication over long distances adds latency, so near-zero RPO with a distant site often uses synchronous replication to a nearby site and asynchronous replication to the far site.
Resilience, high availability, QoS and fault tolerance
| Concept | Meaning |
|---|---|
| High availability (HA) | Clusters and failover keep services running |
| Fault tolerance | Systems continue despite component failure (RAID, redundant power) |
| Quality of service (QoS) | Prioritizes critical traffic during congestion |
| Resilience | Ability to absorb and recover from disruption |
RAID protects against disk failure, not against deletion or ransomware; it is not a backup.
How the exam asks about this
- "Recover within 24 hours, leased equipment pre-installed, data from backup." Warm site.
- "Primary and secondary sites share a utility and carrier; a regional outage took both down." Move the secondary to a region with separate utilities.
- "Database RPO 30 minutes; VM images replicate every four hours." Add log shipping more often than every 30 minutes.
What to remember for the exam
- Full, incremental and differential trade backup speed against restore speed.
- Keep an immutable, separately managed backup copy.
- Cold, warm, hot, mirrored: faster recovery costs more.
- Pilot light keeps a minimal core; warm standby runs a scaled-down full copy.
- Recovery sites must avoid shared risks; RAID is not a backup.
Reciprocal agreements are cheap but unreliable: the partner may lack capacity or be hit by the same disaster.
Common mistakes
Restoring only databases in tests while configurations and keys are missing.
Placing the recovery site near the primary.
Treating replication as backup. Deletions and corruption replicate too.
Check yourself
What does a restore need with differential backups?
The last full backup plus the latest differential.
Which recovery site has space and power but no installed equipment?
A cold site.
What is the main weakness of a reciprocal agreement?
The partner's capacity and suitability during a disaster are uncertain.
Topic 7 of 9 in Security Operations
Test yourself on Security Operations
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.