Lesson 5.47: Backups the business can rely on
Every organisation says it has backups. The questions that matter after ransomware are different: is there a copy the attacker couldn't reach or change, and can each system be restored within the time and data loss the business agreed? Those targets are the recovery time objective (RTO) and recovery point objective (RPO), and only restore tests show whether they're met. In the lab you check Northwind's backup copies against the 3-2-1-1-0 rule of thumb and compare the last restore tests with each system's RTO and RPO.
16 min
You will learn to
- Explain RTO and RPO
- Apply the 3-2-1-1-0 rule of thumb
- Find systems without an immutable copy
- Compare restore tests with RTO and RPO
- Report gaps the business must decide on
Key terms
- RTO
- Recovery time objective: how long a system may be down before the harm is unacceptable.
- RPO
- Recovery point objective: how much data, measured in time, may be lost.
- 3-2-1-1-0
- Rule of thumb: 3 copies, 2 media, 1 off-site, 1 offline or immutable, 0 restore errors.
- Immutable backup
- A copy that can't be changed or deleted until its retention ends (object lock, WORM).
- Restore test
- Actually restoring a system and measuring time and data loss.
← The first ten minutes on a new server · All lessons · Cyber insurance: what the policy really says →