Lesson 4.12: Backups and recovery
Backups are the reason a ransomware attack can be a bad week instead of the end of a company, but only backups the attacker can't reach or change. The 3-2-1-1-0 rule, immutable and offline copies, and why a backup isn't real until you've restored it. RPO and RTO turn 'how much can we lose' and 'how long can we be down' into numbers. In the lab you find the online backups encrypted too, verify the immutable copies with their checksums, restore to a staging folder instead of over the evidence, and work out exactly what data was lost.
17 min
You will learn to
- Explain the 3-2-1-1-0 rule
- Explain immutable and offline backups
- Verify backups with checksums
- Restore to a staging location
- Define RPO and RTO
Key terms
- 3-2-1-1-0 rule
- 3 copies of data, on 2 different media, 1 off-site, 1 offline or immutable, 0 errors in restore tests.
- Immutable backup
- A backup that can't be changed or deleted until a retention date, by anyone.
- Offline / air-gapped backup
- A copy with no network connection to production, such as rotated tapes or disconnected disks.
- RPO
- Recovery point objective: the maximum acceptable data loss, measured in time.
- RTO
- Recovery time objective: the maximum acceptable time until a service works again.
← Wildcards and path expansion · All lessons · DHCP: how devices get their network settings →