Disaster Recovery Criteria

Video Activity
Join over 3 million cybersecurity professionals advancing their career
Sign up with
Required fields are marked with an *
or

Already have an account? Sign In »

Time
12 hours 57 minutes
Difficulty
Intermediate
CEU/CPE
13
Video Transcription
00:00
>> We're going to continue
00:00
our discussion of disaster recovery and
00:00
business continuity by talking about
00:00
the specific criteria related to disaster recovery.
00:00
In this lesson, we're going to explain
00:00
the key performance indicators for disaster recovery,
00:00
identify the priorities for disaster recovery process,
00:00
and help an organization determine and identify
00:00
the key disaster recovery metrics for the business case.
00:00
First and foremost, maximum allowable downtime, MAD.
00:00
This is easy to remember because you'll be MAD
00:00
that your organization doesn't exist.
00:00
Your maximum allowable downtime is the amount of
00:00
time an interruption service
00:00
will basically end your business.
00:00
If your customers say, hey,
00:00
I can't tolerate this product or service
00:00
not being available after a week,
00:00
that's your maximum allowable downtime.
00:00
Then we also want to talk about
00:00
your recovery time objective.
00:00
A recovery time objective is really a goal for
00:00
recovery of operational capabilities
00:00
after an interruption in service.
00:00
It doesn't necessarily have to mean
00:00
they are fully up and going,
00:00
but the capabilities for
00:00
critical functions have to be up and established.
00:00
This is your recovery time objective.
00:00
The recovery point objective is the goal for
00:00
limiting the loss of data when an unplanned event occurs.
00:00
Now, it's measured in time,
00:00
which seems a little unusual,
00:00
but you really are thinking like,
00:00
well over this amount of time based on
00:00
our network traffic baseline
00:00
and the amount of data that's
00:00
produced in our environment,
00:00
this is the estimate of the amount
00:00
that we think we can lose
00:00
without causing too much of
00:00
a compromise to our ongoing operations.
00:00
That's how you should think about it. The time
00:00
measuring the loss of data, recovery point objective.
00:00
Then the annual loss expectancy.
00:00
This metric is really a combination of
00:00
two different metrics when it comes
00:00
to thinking about disaster recovery.
00:00
The annual loss expectancy
00:00
measures the amount of money an organization
00:00
expected to lose on an annual basis because of
00:00
certain disaster recovery scenarios
00:00
or even risks more generally,
00:00
it's really comprised of two different measurements.
00:00
The annual rate of occurrence,
00:00
how frequently something is
00:00
likely to occur within a given year,
00:00
and then the single loss expectancy.
00:00
What's the cost that something's going to happen?
00:00
That's a meteorite destroys your data center.
00:00
The probability, the annual
00:00
rate of occurrence for that extremely low,
00:00
the single loss expectancy,
00:00
probably catastrophic in the millions,
00:00
maybe tens of millions
00:00
depending on the size of the facility.
00:00
Now, when it comes to things like that,
00:00
you really should think of the annual loss expectancy as
00:00
the probability that a catastrophic event
00:00
is going to happen within a given year.
00:00
It's important when planning out disaster recovery
00:00
because you should really only be
00:00
planning for scenarios that are likely to happen,
00:00
then you're going to have enough of an impact,
00:00
and you want to budget below that value for
00:00
the annual loss expectancy because anything over
00:00
is really wasting money,
00:00
trying to fix a situation
00:00
that's not going to occur that often.
00:00
Quiz question, which metric
00:00
reflects the organization's goal for
00:00
limiting data lost during disaster recovery?
00:00
Is it the maximum allowable downtime,
00:00
MAD recovery point objective,
00:00
RPO, recovery time objective, RTO?
00:00
If you say recovery point objective, you're correct.
00:00
Although it is captured in terms of time,
00:00
is the amount of data that an organization can
00:00
lose without compromising their business operations.
00:00
In summary, we talked about
00:00
the key metrics used in disaster recovery,
00:00
MAD, RTO, RPO,
00:00
and then the annual loss expectancy.
00:00
Then we talked about the considerations
00:00
when setting these metrics.
00:00
Some organizations are more sensitive
00:00
to MAD than others,
00:00
others can be unavailable for long periods of time.
00:00
Others their customers are
00:00
relying on data or the data quality,
00:00
so their RPO may be very
00:00
short compared to other organizations.
00:00
All of these metrics should really be defined for
00:00
a given organization's business recovery process.
00:00
Based on their business case,
00:00
what their customers expect,
00:00
what they're contractually obligated to provide,
00:00
and how dynamic their data is.
00:00
I hope we've given you something to consider when
00:00
designing your disaster recovery process,
00:00
and I'll see you in the next lesson.
Up Next