Unit 2: Disaster Recovery and Fault Tolerance -> Generated and Prepared By Thiruselvan (ThiruXD)

TABLE OF CONTENT

PART 1: DISASTER RECOVERY FUNDAMENTALS

1.1 Why Plan for the Worst?
- Defining a Disaster
- Types of Disasters
- Critical Planning Principles
  - Correlated Failures
  - Failure of the Recovery Mechanism
  - The "Blast Radius"
- The Recovery Paradox
1.2 Business Continuity vs. Disaster Recovery
- BCP vs DRP Comparison
- Core Distinction
1.3 Business Impact Analysis (BIA): The Planning Foundation
- The Six-Step BIA Process
  - Scope Definition
  - Information Gathering
  - Critical-Function Identification
  - Impact Quantification
  - Recovery-Objective Definition
  - BIA Report
- Impact Dimensions
  - Financial
  - Regulatory
  - Reputational

PART 2: RECOVERY METRICS AND TIERS

2.1 Core Recovery Metrics
- RTO (Recovery Time Objective)
- RPO (Recovery Point Objective)
- MTD (Maximum Tolerable Downtime)
- WRT (Work Recovery Time)
- The Fundamental Recovery Constraint (RTO + WRT ≤ MTD)
- System Availability Formula
2.2 Availability and Recovery Tiers
- Tier 1: Mission-Critical Functions
- Tier 2: Business-Critical Functions
- Tier 3: Operational / Essential
- Tier 4: Non-Critical / Support
2.3 Recovery Strategies and DRP Lifecycle
- DRP Lifecycle Phases
- Recovery Site Types
  - Hot Site
  - Warm Site
  - Cold Site
  - Cloud / DRaaS
  - Reciprocal / Mobile
- DRP Testing Ladder
  - Checklist
  - Tabletop
  - Parallel
  - Partial Interruption
  - Full Interruption
2.4 Historical Case: Maersk NotPetya Recovery (2017)
- Incident Overview
- The "Ghana Miracle"
- Recovery Timeline
- Strategic Security Lessons

PART 3: BACKUP STRATEGIES

3.1 The Strategic Balance
- Key Strategic Decisions
  - Frequency
  - Retention
  - Media & Location
  - Security
- Primary Drivers (RPO & RTO)
3.2 Backup Types Compared
- Full Backup
- Incremental Backup
- Differential Backup
- Backup Schedule Strategies
  - Full + Daily Incremental
  - Full + Daily Differential
- Comparison Table (Incremental vs Differential)
- Continuous Data Protection (CDP) / Near-CDP
3.3 The 3-2-1 and 3-2-1-1-0 Rules
- The Classic 3-2-1 Rule
  - Three Copies of Data
  - Two Different Media Types
  - One Copy Off-site
- The Modern 3-2-1-1-0 Rule
  - One Offline or Immutable Copy
  - Zero Unverified Errors
- Strategic Resilience: Combating Ransomware
3.4 Backup Media and Location Decisions
- Storage Media Comparison
  - Magnetic Tape
  - HDD / SSD
  - Cloud Object
  - WORM / Optical
- Location & Disaster Risk
  - On-Site
  - Vaulted Off-site
  - Cloud / DRaaS
  - Hybrid
- Security Decision Guidelines
3.5 Backup Verification Checklist
- Continuous Job Monitoring
- File-Level Restoration Sampling
- Full-System Restoration Exercise
- Cryptographic Integrity Checks
- Automated Sandbox Verification
- The Strategic Mandate
- Recovery Success Criteria

PART 4: FAULT TOLERANCE

4.1 Fault Tolerance vs High Availability vs Disaster Recovery
- Comparison Framework
- Failure Scope Hierarchy
4.2 Redundancy Layers & Single Points of Failure
- Power Redundancy
- Hardware Redundancy
- Network Redundancy
- Software Redundancy
- Data Redundancy
- Geographic Redundancy
4.3 RAID Building Blocks
- Striping
- Mirroring
- Parity
- RAID Is Not a Backup (Critical Distinction)
4.4 RAID Levels
- RAID 0: Striping
- RAID 1: Mirroring
- RAID 5: Distributed Parity
- RAID 6: Dual Parity
- RAID 10: 1+0 (Hybrid)
- The Hot Spare Strategy
- RAID 5 Risks
- RAID 6 Advantages
4.5 High-Availability Clustering
- Active-Passive Model
- Active-Active Model
- The Failover Mechanism
  - Heartbeat Monitoring
  - Automatic Failover Process

PART 5: ANTI-MALWARE AND DETECTION

5.1 Antivirus Software
- Definition (Malware & Antivirus)
- AV Core Objectives
  - Prevent
  - Detect
  - Quarantine
  - Remediate
- Scanning Methods
  - On-Access Scanning
  - On-Demand Scanning
- The Modern Shift (Legacy AV → EDR)
5.2 Detection Methodologies
- Detection Methodology Trade-offs
  - Signatures
  - Heuristics & Behavior
  - Sandboxing
- Operational Best Practices
  - Automated Updates
  - Real-time Protection
  - Quarantine Management
  - Exclusion Audits
  - Full Scans
- Critical Security Gaps
5.3 Spyware Threat Profile
- Types of Spyware
  - Keyloggers
  - Browser Hijackers & Adware
  - Credential Stealers
  - Remote Access Tools (RATs)
  - Mobile Surveillance
- Infection Indicators
- Detection Sources
  - Signatures & File Hashes
  - Persistence Monitoring
  - Process Behavior
  - Network Telemetry
  - Reputation Services
- Safe Response & Removal
  - Isolate Endpoint
  - Preserve Evidence
  - Scan and Eradicate
  - Reset Credentials
  - Hardening

PART 6: SIGNATURE-BASED DETECTION

6.1 What is a Malware Signature?
- Core Definition
- Six Typical Signature Forms
  - Exact Byte Sequence
  - Full-File Hash
  - String Pattern
  - YARA Rule
  - Generic Family Signature
  - Behavioral Sequence
- Exact Identity vs Family vs Behaviour
- Specificity Spectrum
6.2 Creating and Using a Signature
- The Signature Lifecycle
  - Collection
  - Refinement
  - Creation
  - Validation
  - Publication
  - Action
- Operational Guidelines
- Illustrative YARA Rule
6.3 Why Typical Signatures Fail
- Fundamental Weaknesses
  - Zero-Day Vulnerability
  - Hash Fragility
  - Obfuscation & Packing
- Structural Code Evasion
  - Polymorphic Malware
  - Metamorphic Malware
  - Sandbox Awareness
- Fileless & Memory-Only Threats
- Strategic Shift

PART 7: CHECKSUMS AND ERROR DETECTION

7.1 Simple Byte-Stream Checksum
- Mechanics of Operation
- Numerical Example: "Hi"
- Inherent Weaknesses
  - Byte Reordering (Transposition)
  - Collision Susceptibility
  - Vulnerability to Forgery
- Key Takeaway
7.2 CRC: Cyclic Redundancy Check
- How CRC Works
- Common Applications
- The Security Boundary (Accidental vs Adversarial)
7.3 Custom Checksums
- Design Requirements
- Common Algorithmic Options
  - Simple Sum
  - Adler-32
  - Fletcher-32
  - CRC-32
- Position-Weighted Schemes
- Critical Limitation
- The Golden Selection Rule
- Verification Checklist

PART 8: CRYPTOGRAPHIC HASHES

8.1 Cryptographic Hash Fundamentals
- Core Properties
  - Deterministic
  - Fixed Output Length
  - Pre-image Resistance
  - 2nd Pre-image Resistance
  - Collision Resistance
  - Avalanche Effect
8.2 Major Hash Algorithms Compared
- MD5
- SHA-1
- SHA-256
- SHA-3
- BLAKE2
- Critical Implementation Rule
8.3 Why MD5 and SHA-1 Are Broken
- The Core Threat: Collision Attacks
- MD5 (128-bit)
  - Rogue CA Certificate (2008)
- SHA-1 (160-bit)
  - SHAttered Attack (2017)
- Security Mandate: Immediate Migration Required
8.4 Hashes in File Integrity and Malware Detection
- File Integrity & Baselines
  - Establishing Trust
  - Secure Storage
  - Verification Cycle
  - FIM Alerts
- Malware Identification
  - Indicators of Compromise (IoC)
  - Fast Lookups
  - The "Brittleness" Problem
  - Polymorphism
- Strategic Shift
8.5 Digital Signatures
- The Signing Mechanism
  - Generate Digest
  - Encrypt Digest
  - Distribute Package
- The Verification Mechanism
  - Decrypt Signature
  - Independent Re-hash
  - Comparative Check
- Functions of Digital Signatures
  - Integrity
  - Authentication
  - Non-repudiation

PART 9: ADVANCED SIGNATURES

9.1 Advanced Malware Signatures
- Key Distinction (Digital Signature vs Malware Signature)
9.2 Fuzzy Hashing
- Why Fuzzy Hashing?
  - Limitations of Cryptographic Hashes
  - The Detection Gap
- The Fuzzy Hashing Solution
  - Context-Triggered Piecewise Hashing (CTPH)
  - Features: Comparable Signatures, Variant Detection, Robustness, Similarity Scoring
9.3 SSDEEP Algorithm
- Process Flow
  - Block Size Selection
  - Rolling Hash & Trigger Boundaries
  - Piecewise Hashing
  - Dual-Signature Generation
  - Edit Distance Comparison
9.4 Fuzzy Hash Use Cases and Alternatives
- Algorithm Comparison
  - SSDEEP
  - TLSH
  - SDHash
  - LZJD
- Key Use Cases
  - Variant Detection
  - Malware Clustering
  - Phishing Similarity
  - Code Attribution
  - Incident Triage
- Key Teaching Point
9.5 CFG Hashing and Import Hashing
- Control Flow Graph (CFG) Hashing
  - Structural Analysis
  - Resilience
  - Clustering
  - BinDiff Integration
- Import Hashing (ImpHash)
  - API Profile
  - Efficiency
  - Fingerprinting
  - Limitation

PART 10: TECHNIQUE SELECTION MATRIX

Selecting the Optimal Integrity and Recovery Technique
- Detecting Accidental Data Corruption
- Verifying Exact File Integrity
- Ensuring Message Integrity with Authentication
- Verifying File Origin, Integrity, and Non-repudiation
- Identifying Structurally Similar Malware Variants
- Analyzing Binary Code Structure
- Grouping Malware by API Profiles
- Maintaining Continuous Service and Availability

PART 11: KEY TAKEAWAYS

Key Takeaways
- Disaster Recovery
- Fault Tolerance
- Detection Techniques

PART 1: DISASTER RECOVERY FUNDAMENTALS

1.1 Why Plan for the Worst?

Defining a Disaster

Disaster: Any event that causes a disruption beyond normal operating procedures, requiring extraordinary measures to restore stability and service.

Types of Disasters

Category	Examples
Natural	Earthquakes, floods, storms, wildfires
Cyber/Human	Ransomware, sabotage, human error
Technical	Power grid failure, hardware crashes
Supply Chain	Third-party vendor or logistics failure
Health	Pandemics, mass workforce absence

Critical Planning Principles

Principle	Description
Correlated Failures	Planning must account for events that trigger secondary failures (e.g., a flood causing a power outage)
Failure of the Recovery Mechanism	What happens if the backup systems or the DRP itself fails during the incident?
The “Blast Radius”	Understanding the geographic and operational span of a single event

The Recovery Paradox

Key Insight: A recovery plan is only a “plan” until it is tested. An untested recovery mechanism is often the first thing to fail when a real disaster strikes.

Resilience requires planning for the failure of your backup plan.

1.2 Business Continuity vs. Disaster Recovery

DRP is a technical subset of the broader BCP framework.

Feature	Business Continuity (BCP)	Disaster Recovery (DRP)
Scope	Organization-wide; business processes and people	IT systems, data, networks, and infrastructure
Goal	Continuous operations and organizational resilience	Restoration of technical assets after a disaster
Timing	Proactive and ongoing during disruption	Reactive; initiated post-disruption
Ownership	Executive Leadership & Business Unit Heads	IT Management, CIO, & Technical Teams
Output	Crisis management & relocation plans	Technical runbooks & data restore procedures

Core Distinction: BCP asks “How do we keep the doors open?”, while DRP asks “How do we get the servers back online?”

1.3 Business Impact Analysis (BIA): The Planning Foundation

The Six-Step BIA Process

Step	Description
01 Scope Definition	Establish boundaries and prioritize specific organizational units
02 Information Gathering	Collect data via surveys, interviews, and automated discovery
03 Critical-Function Identification	Distinguish essential operations from supportive tasks
04 Impact Quantification	Assign monetary and non-monetary values to potential losses
05 Recovery-Objective Definition	Set specific time and data loss targets (RTO/RPO)
06 BIA Report	Formalize findings to guide executive recovery strategy decisions

Impact Dimensions

Dimension	Description
Financial	Lost revenue, idle labor costs, and contractual penalties
Regulatory	Legal fines, compliance breaches, and litigation risk
Reputational	Long-term brand damage and market value decline

Key Teaching Message: Without a rigorous BIA foundation, all subsequent recovery decisions (RTO/RPO) become mere guesswork and lack strategic alignment.

PART 2: RECOVERY METRICS AND TIERS

2.1 Core Recovery Metrics

Metric	Definition	Question It Answers
RTO (Recovery Time Objective)	Maximum acceptable duration of an outage	“How quickly must we recover?”
RPO (Recovery Point Objective)	Maximum acceptable data loss (measured in time)	“How much data can we afford to lose?”
MTD (Maximum Tolerable Downtime)	Absolute limit before irreversible harm occurs	“What’s the breaking point?”
WRT (Work Recovery Time)	Time needed to validate data and resume normal ops	“How long to get back to full capacity?”

The Fundamental Recovery Constraint

RTO + WRT ≤ MTD

System Availability Formula

Availability = MTBF / (MTBF + MTTR)

Where:

MTBF: Mean Time Between Failures
MTTR: Mean Time To Repair

2.2 Availability and Recovery Tiers

Criticality Drives Architecture: As RTO and RPO objectives tighten, the complexity and cost of the recovery solution increase exponentially. Tier classification ensures resources are allocated to the most vital business functions.

Recovery Tier	Classification	RTO (Target)	RPO (Target)
Tier 1	Mission-Critical Functions	< 1 Hour	Near-Zero / Minutes
Tier 2	Business-Critical Functions	4 – 8 Hours	1 – 4 Hours
Tier 3	Operational / Essential	24 – 48 Hours	Up to 24 Hours
Tier 4	Non-Critical / Support	72+ Hours	Varies (Days)

Note: Tier 0 typically represents continuous availability (Fault Tolerance).

2.3 Recovery Strategies and DRP Lifecycle

DRP Lifecycle Phases

Initiate → 2. BIA → 3. Select Strategy → 4. Develop Plan → 5. Implement → 6. Test → 7. Maintain

Recovery Site Types

Site Type	Characteristics & Readiness	Relative Cost
Hot Site	Fully configured; mirrored data; ready in minutes/hours	Highest
Warm Site	Equipped with hardware; requires data restoration	Medium
Cold Site	Shell space; power/cooling only; long setup time	Lowest
Cloud / DRaaS	Virtualized; flexible; pay-per-use; high scalability	Variable
Reciprocal / Mobile	Mutual aid agreements or trailer-based mobile units	Low-Medium

DRP Testing Ladder

Test Type	Description
Checklist	High-level review of plan components
Tabletop	Role-play scenario in a meeting room
Parallel	Systems run at DR site without interruption
Partial Interruption	Test critical systems only
Full Interruption	Entire site cutover (highest risk)

2.4 Historical Case: Maersk NotPetya Recovery (2017)

Incident Overview

Impact: USD 300 Million Revenue Impact
Cause: NotPetya ransomware propagated globally, encrypting entire Active Directory (AD) infrastructure in minutes

The “Ghana Miracle”

“The only reason we were able to recover was because of a power cut in Ghana. That domain controller was the only surviving copy of our Active Directory data.”

Recovery Timeline:

IT found a single surviving domain controller in Ghana
Saved by a timely local power outage that kept it offline
Hard drive flown from Lagos to London
Served as the master seed for global network reconstruction

Strategic Security Lessons

Lesson	Application
Offline AD Backups	Keep immutable, air-gapped copies of critical identity infrastructure
Network Segmentation	Prevent lateral movement of malware across global geographic sites
Geographic Isolation	Validate that “global” systems have localized resilience points
Supply Chain Vigilance	NotPetya entered via a compromised software update (M.E.Doc)

PART 3: BACKUP STRATEGIES

3.1 The Strategic Balance

Definition: A backup is a separate, independent copy of data that enables restoration following loss, corruption, or destruction. It is the final safety net for business continuity.

Key Strategic Decisions

Decision Area	Considerations
Frequency	How often snapshots are taken (Hourly vs. Daily)
Retention	How long historical versions are kept (Compliance)
Media & Location	Cloud, Tape, or Disk; On-site vs. Off-site
Security	Encryption at rest and in transit; Access control

Primary Drivers

RPO → Determines Frequency: “How much data can we afford to lose?” (e.g., 1 hour of transactions)
RTO → Determines Restore Speed: “How quickly must we be back online?” (e.g., 4 hours)

3.2 Backup Types Compared

Backup Type	Description	Backup Speed	Restore Speed	Storage Usage
Full Backup	Copies all selected data	Slowest	Fastest (single source)	Highest
Incremental Backup	Copies changes since any previous backup	Fastest	Slowest (must process every incremental)	Lowest
Differential Backup	Copies changes since last Full backup	Moderate	Fast (Full + 1 Differential)	Higher

Backup Schedule Strategies

Full + Daily Incremental

Sunday: Full Backup of all selected data
Daily: Captures changes since any previous backup
Pros: Fastest backup window; minimal storage growth
Cons: Requires complex “chain” of all files for restoration

Full + Daily Differential

Sunday: Full Backup of all selected data
Daily: Captures changes since last Full backup
Pros: Only two components needed for any restoration
Cons: Daily backup size grows as the week progresses

Comparison Table

Metric	Incremental Strategy	Differential Strategy
Backup Speed	Very Fast (smallest daily delta)	Moderate (grows daily)
Restore Speed	Slowest (must process every incremental)	Fast (Full + 1 Differential)
Storage Usage	Lowest (no redundancy between backups)	Higher (redundant data in daily diffs)

Continuous Data Protection (CDP) / Near-CDP

Supports minute or second-level RPO
Captures every data change/snapshot
Ideal for mission-critical databases where data loss must be near-zero

3.3 The 3-2-1 and 3-2-1-1-0 Rules

The Classic 3-2-1 Rule

Rule Component	Description
3 Copies of Data	Keep at least one primary copy and two additional backups to mitigate the risk of a single point of failure
2 Different Media Types	Store backups on different technologies (e.g., Disk + Tape, or NAS + Cloud) to avoid correlated hardware failures
1 Copy Off-site	Geographic separation protects against site-wide disasters like fire, flood, or regional power outages

The Modern 3-2-1-1-0 Rule

Extension	Description
1 Offline or Immutable Copy	Maintain an Air-Gapped or WORM (Write Once, Read Many) copy that ransomware cannot encrypt or delete
0 Unverified Errors	Automated recovery verification. A backup is not a backup until it has been successfully restored and validated

Strategic Resilience: Combating Ransomware

Modern backup architecture must prioritize immutability. Air-gapped backups (physically disconnected) or logical WORM storage ensure that even if administrative credentials are compromised, the historical data remains untouchable. Verification (the “0” in 3-2-1-1-0) ensures the restore path is functional within RTO constraints.

3.4 Backup Media and Location Decisions

Storage Media Comparison

Media Type	Key Characteristics	Restore Speed
Magnetic Tape	Low cost/GB, high capacity, offline storage (air-gap). Best for retention	Very Slow
HDD / SSD	Direct access, NAS/SAN integration. Vulnerable to ransomware if online	Very Fast
Cloud Object	Infinite scalability, managed by 3rd party. Off-site by design	Moderate
WORM / Optical	Write-Once-Read-Many. Immutable data protection. High durability	Slow

Location & Disaster Risk

Location	Primary Benefits	Site Disaster Protection
On-Site	LAN speed restoration, immediate physical access. No bandwidth cost	Zero Protection
Vaulted Off-site	Physical isolation from regional disasters. High security	High Protection
Cloud / DRaaS	Geographic diversity, accessible from any internet connection	High Protection
Hybrid	Local cache for speed + Cloud sync for geographic safety	Balanced

Security Decision: Select Media based on RTO/RPO and Cost; Select Location based on Site Disaster Risk and Ransomware Reachability. Always maintain one offline (air-gapped) copy to ensure recovery from destructive cyber-attacks.

3.5 Backup Verification Checklist

Checklist Item	Description
Continuous Job Monitoring	Review logs daily for partial failures, skipped files, or timeout errors
File-Level Restoration Sampling	Perform random restore tests of individual files to ensure media readability
Full-System Restoration Exercise	Validate the entire restore chain (Full + Differentials/Incremental)
Cryptographic Integrity Checks	Calculate SHA-256 at write and verify at restore to detect bit-rot or tampering
Automated Sandbox Verification	Use isolated VMs to automatically boot and verify recovery environments

The Strategic Mandate

“A backup is only valid if it restores within the required RTO and meets the required RPO.”

Recovery Success Criteria

Measured Restore Time ≤ RTO

Warning: An untested DRP is a liability, not a protection. Restoration speed is often bottlenecked by bandwidth, decryption, or media latency.

PART 4: FAULT TOLERANCE

4.1 Fault Tolerance vs High Availability vs Disaster Recovery

Comparison Framework

Aspect	Fault Tolerance	High Availability	Disaster Recovery
Primary Objective	Zero downtime and continuous service	Minimized downtime and uptime maximization	Restoration of service after site loss
Mechanism	Hardware redundancy; duplicate components operating in parallel	Clustering, load balancing, and automated failover to standby	Off-site backups, secondary data centers, and DRP runbooks
Scope of Loss	Zero data loss; zero interruption during failure	Brief interruption; minimal/negligible data loss	Acceptable downtime (RTO) and data loss (RPO)
Characteristics	Highest cost and complexity; handles component failures transparently	Focuses on service continuity despite system software or server failures	The final safety net; involves manual or scripted site-level rebuilding

Failure Scope Hierarchy

Component-Level Failure → Fault Tolerance
System/Service Interruption → High Availability
Site-Wide Catastrophe → Disaster Recovery

4.2 Redundancy Layers & Single Points of Failure

Power Redundancy

Uninterruptible Power Supplies (UPS)
Backup Diesel Generators
Dual Power Distribution Units (PDUs)
Redundant Utility Grid Feeds

Hardware Redundancy

Redundant Power Supplies (PSUs)
NIC Teaming / Link Aggregation
ECC Memory & Hot-spare CPU
RAID Storage (Local Resilience)

Network Redundancy

Dual ISPs (Diverse Path Routing)
Redundant Core Switches & Routers
BGP Multi-homing
Load Balancers (Traffic Distribution)

Software Redundancy

Active-Passive/Active-Active Clusters
Microservices / Containers
Application Failover Logic
Health Check Heartbeats

Data Redundancy

Database Replication (Async/Sync)
Distributed File Systems
Cloud Object Versioning
Continuous Data Protection (CDP)

Geographic Redundancy

Multi-Region Deployment
Cloud Availability Zones (AZ)
Off-site Disaster Recovery Centers
Global Load Balancing (GSLB)

4.3 RAID Building Blocks

RAID Concepts

Concept	Description	Characteristics
Striping	Splits data into “stripes” or chunks across multiple physical disks	Increases I/O performance. Allows parallel read/writes. Increases capacity utilization. Provides zero redundancy
Mirroring	Simultaneously writes the exact same data to two or more disks	Full data duplication. Highest fault tolerance. Shortest recovery time. 50% storage overhead
Parity	Calculates binary logic (XOR) to store mathematical checksums	Reconstructs lost data. Balances capacity and safety. Efficient space utilization. Write performance penalty

RAID Is Not a Backup

CRUCIAL DISTINCTION: RAID IS NOT A BACKUP

RAID protects against physical hardware (disk) failure, but it does NOT provide data protection for other threats.

RAID offers zero protection against:

File deletion (deletion is instantly mirrored)
Corruption (corruption is instantly mirrored)
Ransomware (encryption is instantly mirrored)
Human error (mistakes are instantly mirrored)
Site-wide disasters (fire, flood, theft)

Teaching Point: If you delete a file on a RAID 1 (Mirror), the deletion is instantly “mirrored” to the other disk. The data is gone.

4.4 RAID Levels

RAID Level Comparison

RAID Level	Description	Min Drives	Fault Tolerance	Performance	Best Use Case
RAID 0	Striping	2	0 (Zero)	Max Read/Write	Temporary files, non-critical data
RAID 1	Mirroring	2	1 Drive	High Read, Normal Write	Critical data with simple redundancy
RAID 5	Distributed Parity	3	1 Drive	Good Read, Moderate Write	Standard storage/file servers
RAID 6	Dual Parity	4	2 Drives	Slower writes than RAID 5	Large drives; survives failure during rebuild
RAID 10	1+0 (Hybrid)	4	1 per mirror pair	Peak IOPS/Low latency	Databases and high-load apps

The Hot Spare Strategy

An idle, powered-on drive ready to automatically replace a failed disk, initiating an immediate background rebuild to minimize the window of vulnerability.

RAID 5 Risks

Long rebuild times on large drives
Risk of second failure during rebuild
Performance degradation during rebuild

RAID 6 Advantages

Survives 2 drive failures
Crucial for large capacity drives
Protects during rebuild operations
Added parity write penalty

4.5 High-Availability Clustering

Active-Passive Model

Feature	Description
Operation	Cold/Warm Standby: Secondary node remains idle until the primary fails
Management	Simple: No complex state synchronization required for concurrent traffic
Utilization	Lower: 50% of hardware resources are typically dormant
Failover Time	Service pause while standby node takes over resources

Active-Active Model

Feature	Description
Operation	Load Distribution: All nodes actively serve requests simultaneously
Throughput	High: Maximizes hardware utilization and capacity
Complexity	Requires robust session state sharing and locking
Resilience	Surviving nodes absorb the load of the failed component

The Failover Mechanism

Heartbeat Monitoring:

A dedicated network link or “keep-alive” signal between nodes
If the heartbeat is lost, the cluster initiates a failure detection protocol

Automatic Failover Process:

Detect Failure
Verify (Quorum)
Reassign IP/Services
Update Load Balancer
Restore Traffic

PART 5: ANTI-MALWARE AND DETECTION

5.1 Antivirus Software

Definition

Malware: Malicious software designed to infiltrate, damage, or disrupt computer systems
Antivirus (AV) : A software suite designed to prevent, detect, and remediate malicious files and processes

AV Core Objectives

Objective	Description
Prevent	Block malicious code before execution (Email/Web)
Detect	Identify existing infections through scanning
Quarantine	Isolate suspicious files in a secure container
Remediate	Disinfect files or remove the malware entirely

Scanning Methods

Method	Description
On-Access Scanning	Real-time protection. Scans files as they are opened, copied, or executed. Monitors active system processes. Intercepts downloads and email attachments
On-Demand Scanning	User-initiated or scheduled deep scans of the filesystem. Full system scans (thorough but resource intensive). Specific directory/removable media scans

The Modern Shift

Transition from Legacy AV (Signature-heavy) to EDR (Endpoint Detection and Response), emphasizing behavioral monitoring and active response telemetry.

5.2 Detection Methodologies

Detection Methodology Trade-offs

Method	Strengths	Limitations
Signatures	• Extremely fast execution• High precision (low false positives)• Definitive identification of known threats	• Blind to “Zero-Day” attacks• Defeated by minor code changes• Requires frequent database updates
Heuristics & Behavior	• Detects unknown variants• Identifies “Zero-Day” patterns• Monitors real-time process actions	• High False Positive rate• Significant performance overhead• Risk of blocking legitimate software
Sandboxing	• Safely executes suspicious files• Deep visibility into malware intent	• Slow (latency in execution)• “Sandbox-aware” malware remains dormant

Operational Best Practices

Practice	Description
Automated Updates	Maintain real-time signature and engine parity
Real-time Protection	Enable on-access scanning for all I/O operations
Quarantine Management	Regular review of isolated files to minimize data loss
Exclusion Audits	Strictly control and audit scan exclusion lists
Full Scans	Schedule periodic deep scans for dormant threats

Critical Security Gaps

Traditional AV often fails against Fileless Malware (living-off-the-land) and Encrypted Payloads. Modern protection requires memory, registry, and network traffic monitoring.

5.3 Spyware Threat Profile

Types of Spyware

Type	Description
Keyloggers	Covertly records every keystroke to exfiltrate passwords, credit card numbers, and confidential messages
Browser Hijackers & Adware	Modifies browser settings (homepages, search engines) and injects unwanted advertisements or redirects
Credential Stealers	Targets specific sensitive data such as banking credentials, cryptocurrency private keys, and session cookies
Remote Access Tools (RATs)	Provides administrative control to an attacker, allowing for file manipulation, webcam access, and software execution
Mobile Surveillance	Specialized spyware for tracking GPS locations, recording calls, and monitoring private messaging apps

Infection Indicators

Indicator
Unexpected browser extensions, toolbars, or frequent redirects
Unusual outbound network connections to unknown IP addresses
Sudden system sluggishness or unexplained high CPU usage
Unauthorized account access or strange security alerts
Webcam indicators lighting up without user alerts

Takeaway: Spyware operates covertly; detection relies on behavioral monitoring and persistence checks.

Detection Sources

Source	Description
Signatures & File Hashes	Matching unique byte sequences and SHA-256 digests of known spyware variants
Persistence Monitoring	Checking Registry keys, Start-up entries, and unexpected browser extensions
Process Behavior	Detecting API hooking, keyloggers, and covert screen-scraping activity
Network Telemetry	Identifying unusual outbound connections to known C2 (Command & Control) servers
Reputation Services	Cloud-based lookups for file, URL, and certificate trustworthiness

Safe Response & Removal

Step	Action
Isolate Endpoint	Disconnect from network to stop data exfiltration
Preserve Evidence	Capture memory dumps or disk images before cleanup for forensic analysis
Scan and Eradicate	Use offline scanners to remove/quarantine malicious files and registry entries
Reset Credentials	Change all passwords from a clean device, as current ones may be compromised
Hardening	Patch vulnerabilities, review extensions, and monitor for reinfection

Critical Warning: Never reset passwords on the infected machine; spyware may still be logging keystrokes during the process.

PART 6: SIGNATURE-BASED DETECTION

6.1 What is a Malware Signature?

Core Definition: A malware signature is a unique byte sequence or pattern that reliably identifies a known malicious file or code. It acts as a fingerprint: the detection engine compares a candidate file against a database of known signatures and flags any match.

Six Typical Signature Forms

Type	Description	Example
Exact Byte Sequence	Fixed hex pattern at a known offset; fast but brittle — one byte change defeats it	`4D 5A 90 00 E8 ?? ?? 00 00`
Full-File Hash	Cryptographic digest of entire file; exact identity, zero tolerance for any modification	`SHA-256: a3f2...c91b`
String Pattern	Hardcoded command strings, registry keys, or URLs embedded in malware code	`"cmd.exe /c del %temp%\\*"`
YARA Rule	Combines multiple strings/byte patterns with Boolean logic for flexible, expressive matching	`rule Malware { strings: $s = "evil" condition: $s }`
Generic Family Signature	Wildcard or partial pattern covering shared structural code across a malware family	`Trojan.GenericKD.*`
Behavioral Sequence	Ordered API/system-call sequence; identity defined by actions, not bytes	`CreateProcess → WriteFile → RegSetValue`

Exact Identity vs. Family / Behaviour

Type	Description
Exact Identity	Full-file hash (MD5/SHA-256) or precise byte sequence — matches one specific sample only
Family Match	Generic/wildcard pattern covering shared code across a malware family, surviving minor mutations
Behaviour Match	Ordered API/system-call sequence — identifies what the code does, independent of byte content

Specificity Spectrum

Exact (Hash) ←→ Broad (Behaviour)

Exact signatures offer precision; generic and behavioural signatures extend coverage to variants and zero-day-adjacent threats.

6.2 Creating and Using a Signature

The Signature Lifecycle

Step	Description
1. Collection	Gather diverse malware samples and identify stable, distinctive binary code or data segments
2. Refinement	Exclude common benign content (Standard libraries, OS APIs) to prevent false positive detections
3. Creation	Develop patterns using hex byte sequences, string matches, or logic-based YARA rules
4. Validation	Test the rule against massive corpora of both malicious and clean files to ensure accuracy
5. Publication	Distribute verified signatures to endpoints and scanning engines via secure update channels
6. Action	Scan files or memory; trigger automated responses: Alert, Quarantine, or Remediate

Operational Guidelines

Identify code that remains unchanged across different versions of a malware family
Use wildcards (??) to account for variable data or addresses in the byte stream
Balance precision (avoiding FPs) with breadth (detecting variants)

Note: A signature is only as effective as its last update; real-time protection relies on frequent, automated signature feed ingestion.

Illustrative YARA Rule

rule Malware_Family_Alpha
{
    strings:
        $a = { 4D 5A 90 00 ?? ?? 00 00 }
        $b = "malicious_payload"
    condition:
        $a and $b
}

6.3 Why Typical Signatures Fail

Fundamental Weaknesses

Weakness	Description
Zero-Day Vulnerability	No signature exists for unknown threats; protection is absent until a sample is analyzed and the database updated
Hash Fragility	Exact cryptographic hashes (MD5/SHA-256) are defeated by single-byte changes, creating an entirely new digest
Obfuscation & Packing	Compressors and “crypters” hide the actual malicious code, presenting only a benign-looking stub to the scanner

Structural Code Evasion

Technique	Description
Polymorphic Malware	Uses a mutation engine to change its decryption routine while keeping the payload encrypted, breaking static patterns
Metamorphic Malware	Rewrites its own code logic entirely (instruction substitution, dead-code insertion) to change structural signatures
Sandbox Awareness	Detection fails if the malware remains dormant when it senses a virtualized environment or analysis debugger

Fileless & Memory-Only Threats

Traditional scanners look for files on the disk. Fileless malware resides only in RAM or leverages legitimate system tools (PowerShell, WMI) to execute malicious commands. Since there is no “malicious file” to hash or scan for byte patterns, typical signatures are completely bypassed.

Strategic Shift: Because exact signatures are brittle, modern defense must evolve toward Generic Signatures, Heuristics, Behavioral Analysis, and Fuzzy Hashing to detect variants and structural similarities.

PART 7: CHECKSUMS AND ERROR DETECTION

7.1 Simple Byte-Stream Checksum

Mechanics of Operation

A fundamental error-detection technique that treats data as a stream of numeric values (bytes). It is primarily used to detect accidental data corruption during transmission or storage.

Checksum = (Sum of Bytes) mod 256

Process:

Summation: Add the numeric value of each byte in the message
Modulo: Reduce the total sum modulo 256 (for 8-bit)
Verification: Receiver recomputes and compares with the appended value

Numerical Example: “Hi”

Character	Hexadecimal	Decimal Value
‘H’	0x48	72
‘i’	0x69	105
Total Sum	0xB1	177

Result: The checksum 177 (0xB1) is appended to the message “Hi”.

Inherent Weaknesses

Weakness	Description
Byte Reordering (Transposition)	Because addition is commutative, “Hi” (72+105) and “iH” (105+72) both result in 177. The checksum fails to detect sequence errors
Collision Susceptibility	With only 256 possible values (8-bit), different data streams frequently yield the same sum, leading to undetected errors
Vulnerability to Forgery	An attacker can easily modify data and adjust subsequent bytes to maintain the same total sum, making it useless for security

Key Takeaway

Simple byte-stream checksums are suitable for low-level hardware error detection where computational resources are extremely limited, but they offer zero protection against intentional adversarial modification.

7.2 CRC: Cyclic Redundancy Check

Definition: A mathematical algorithm used to detect accidental changes to raw data.

How CRC Works

Polynomial Representation: Data bits are treated as coefficients of a polynomial over the Galois Field GF(2)
Process: The message polynomial is divided by a fixed Generator Polynomial
Result: The remainder is the CRC value

Common Applications

Application	CRC Variant
Networking	Ethernet (CRC-32), Wi-Fi (FCS) to detect transmission noise
Storage	HDD/SSD internal consistency checks
File Formats	ZIP, GZIP, and PNG use CRC-32 to ensure file integrity during decompression

The Security Boundary

Accidental Error Detection ≠ Adversarial Security

CRC is linear and non-cryptographic. An attacker can modify a message and easily recompute a valid CRC to match the forgery. Never use CRC for security or anti-tamper purposes.

7.3 Custom Checksums

Design Requirements

Requirement	Description
Message Profile	Define typical/maximum message size and required output width (8, 16, 32-bit)
Error Model	Identify expected failures (single-bit, burst errors, or byte transpositions)
Computation Limits	Factor in CPU/hardware constraints and real-time processing needs
Implementation Details	Specify endianness, modulo handling, and initial/final XOR values
Interoperability	Ensure consistent versioning across different system architectures

Common Algorithmic Options

Algorithm	Mechanism	Strength	Best Use Case
Simple Sum	Modular Addition	POOR	Legacy systems; very small data chunks where speed is critical
Adler-32	Dual Running Sums	LOW	Zlib/Gzip; faster than CRC but weaker on short messages
Fletcher-32	Dual Modulo Sums	MODERATE	Embedded systems; improved detection of transpositions
CRC-32	Polynomial Division	HIGH	Network (Ethernet), Storage (ZIP, PNG); robust accidental error detection

Position-Weighted Schemes

Assigns weights based on byte index to detect transpositions (e.g., “AB” vs “BA”)
Essential for simple modular sums where order sensitivity is required

Critical Limitation

Custom checksums are designed for Error Detection only. They provide NO protection against intentional, adversarial modification.

The Golden Selection Rule

Requirement	Recommended Technique
Accidental Corruption?	Use Standard CRC or Checksum
Adversarial Integrity?	Use SHA-256, HMAC, or Signatures

Security Warning: Never use a standard checksum to defend against intentional tampering.

Verification Checklist

Test against known test vectors
Verify single-bit error detection
Test burst-error resilience
Check transposition & truncation
Validate platform compatibility

PART 8: CRYPTOGRAPHIC HASHES

8.1 Cryptographic Hash Fundamentals

A cryptographic hash function maps an arbitrary-sized input (message) to a fixed-length bit string (digest or fingerprint). It is a fundamental building block for data integrity and malware identification.

Core Properties

Property	Description
Deterministic	The same input message will always produce the exact same hash digest
Fixed Output Length	Regardless of input size (1KB or 1TB), the output length remains constant (e.g., 256 bits)
Pre-image Resistance	“One-Way” property: Computationally infeasible to find input x given hash value h(x)
2nd Pre-image Resistance	Infeasible to find a second input y that has the same hash as a specific input x
Collision Resistance	Infeasible to find any two different inputs x and y such that h(x) = h(y)
Avalanche Effect	Changing a single bit in the input results in a massive, unpredictable change in the output

8.2 Major Hash Algorithms Compared

Algorithm	Output Bits	Security Status	Performance	Recommended Use Case
MD5	128 bits	Broken	Very Fast	Non-security tasks; legacy file checksums where collision risk is acceptable
SHA-1	160 bits	Broken	Fast	Legacy systems only; deprecated for digital signatures and SSL/TLS certificates
SHA-256	256 bits	Secure	Moderate	Current industry standard for file integrity, digital signatures, and blockchain
SHA-3	224–512 bits	Secure	Moderate	Modern sponge-based design; high-security alternative if SHA-2 is compromised
BLAKE2	Up to 512 bits	Secure	Very Fast	High-performance applications requiring cryptographic strength with low overhead

Critical Implementation Rule: Avoid MD5 and SHA-1 for all new security designs. Migration to SHA-256 or SHA-3 is mandatory for collision resistance and long-term data integrity.

8.3 Why MD5 and SHA-1 Are Broken

The Core Threat: Collision Attacks

A collision occurs when two different inputs produce the exact same hash digest. This violates the 1:1 mapping principle, allowing attackers to substitute legitimate files with malicious ones without changing the resulting signature.

MD5 (128-bit)

Aspect	Detail
Status	Cryptographically broken since 2004
Vulnerability	Collisions can now be generated in seconds on standard consumer hardware
Impact	Undermines file integrity baselines and digital certificates

Rogue CA Certificate (2008): Researchers successfully leveraged MD5 collisions to create a rogue Certificate Authority that was trusted by all major browsers.

SHA-1 (160-bit)

Aspect	Detail
Status	Deprecated for secure uses since 2017
Vulnerability	Theoretical attacks proven practical via massive computational effort (Google/CWI)
Impact	Collision attacks undermine code signing and document integrity

SHAttered Attack (2017): First practical SHA-1 collision: two PDF files with different content (one benign, one malicious) shared the same hash.

Security Mandate: Immediate Migration Required

Cease use of MD5 and SHA-1 for digital signatures, certificates, and integrity checks. Migrate to SHA-256 (SHA-2) or SHA-3 for all adversarial security contexts.

8.4 Hashes in File Integrity and Malware Detection

File Integrity & Baselines

Step	Description
Establishing Trust	Calculate SHA-256 digests for all “known good” system and application files
Secure Storage	Store baseline hashes in a read-only or offline repository to prevent tampering
Verification Cycle	Re-calculate hashes during file transfers, system restores, or scheduled audits
FIM Alerts	Trigger immediate alerts if a file’s current hash deviates from its baseline

Key Goal: Detect unauthorized modifications by attackers or accidental corruption during data movement.

Malware Identification

Method	Description
Indicators of Compromise (IoC)	Exact hashes (SHA-256) serve as high-fidelity signatures for known malware
Fast Lookups	Compare unknown file hashes against global threat intelligence databases (e.g., VirusTotal)
The “Brittleness” Problem	Changing a single byte in a malware file results in a completely different hash
Polymorphism	Modern threats use automated changes to evade hash-based detection easily

Strategic Shift: Exact hashes provide “Identity”; Fuzzy/Structural hashes provide “Similarity.”

8.5 Digital Signatures

The Signing Mechanism

Step	Description
1. Generate Digest	Sender hashes the document using a cryptographic algorithm (e.g., SHA-256) to create a fixed-length digest
2. Encrypt Digest	Sender encrypts the digest with their Private Key. This encrypted digest is the Digital Signature
3. Distribute Package	The original document, the digital signature, and the sender’s public certificate are sent to the recipient

The Verification Mechanism

Step	Description
1. Decrypt Signature	Receiver decrypts the signature using the sender’s Public Key to reveal the original digest
2. Independent Re-hash	Receiver hashes the received document using the same algorithm to compute a new digest
3. Comparative Check	If both digests match, the document is authentic and unaltered. If they differ, the signature is invalid

Functions of Digital Signatures

Function	Description
Integrity	Proves that the document has not been modified since the signature was applied
Authentication	Confirms the origin of the document by linking it to the owner of the private key
Non-repudiation	The signer cannot deny having signed the document, as only they possess the private key

PART 9: ADVANCED SIGNATURES

9.1 Advanced Malware Signatures

Beyond exact byte matching: advanced techniques prove family membership, suspicious behaviour, authenticated integrity, or signer identity.

Key Distinction: A digital signature (asymmetric crypto) authenticates a signer’s identity and ensures document integrity — it is not the same as a malware-detection signature (byte pattern / YARA rule used by AV to identify malicious code). Conflating the two is a common exam error.

9.2 Fuzzy Hashing

Why Fuzzy Hashing?

Limitations of Cryptographic Hashes:

Cryptographic hashes (like SHA-256) are designed for Exact Integrity
Avalanche Effect: A single bit change results in a completely different, unrelated digest
Polymorphism: Malware authors modify a few bytes to evade signature-based detection
Identity vs. Similarity: Traditional hashes prove identity but fail to recognize “kinship” or structural overlap
The Detection Gap: If a malware variant is 99% identical to a known threat, an exact hash lookup will return 0% match

The Fuzzy Hashing Solution

Context-Triggered Piecewise Hashing (CTPH) enables the detection of structurally similar files.

Feature	Description
Comparable Signatures	Similar inputs produce similar digests that can be algorithmically compared
Variant Detection	Efficiently clusters modified malware, recompiled code, and phishing documents
Robustness	Survives minor additions, deletions, or substitutions within the byte stream
Similarity Scoring	Provides a score between 0 and 100 to indicate structural similarity

9.3 SSDEEP Algorithm

Process Flow

Step	Description
01 Block Size Selection	Determines an initial block size b based on file length. The goal is to produce a signature of manageable length (typically 32 to 64 characters) to facilitate efficient comparison
02 Rolling Hash & Trigger Boundaries	A weak rolling hash (Fowler-Noll-Vo) slides byte-by-byte across the file. A segment boundary is “triggered” when the hash state matches a specific condition relative to the block size. Condition: rolling_hash % b == (b - 1)
03 Piecewise Hashing	For each identified segment, a stronger 6-bit non-cryptographic hash is computed. This reduces the entire chunk of data into a single Base64 character in the final fuzzy signature string
04 Dual-Signature Generation	To account for slight variations in file size or small insertions/deletions, SSDEEP outputs two signatures: one at block size b and another at 2b. Format: block_size : hash_b : hash_2b
05 Edit Distance Comparison	Signatures are compared using a weighted Edit Distance (Levenshtein) algorithm. A score of 100 indicates an identical structure, while 0 indicates no detectable similarity

9.4 Fuzzy Hash Use Cases and Alternatives

Algorithm	Mechanism & Primary Strength	Limitation / Note
SSDEEP	Context-Triggered Piecewise Hashing (CTPH). Widely supported in threat intelligence	Brittle to significant byte reordering or content shuffling
TLSH	Trend Micro Locality Sensitive Hash. Uses global clustering for robust similarity	More resilient to reordering than SSDEEP; requires minimum file size
SDHash	Similarity Digest. Uses Bloom filters to capture structural and statistical features	Excellent for cross-correlation between different file formats
LZJD	Lempel-Ziv Jaccard Distance. Uses compression-set logic for similarity	Effective for comparing heavily packed or compressed binary files

Key Use Cases

Use Case	Description
Variant Detection	Identify modified versions of known malware
Malware Clustering	Group similar malware samples by structural similarity
Phishing Similarity	Detect similar phishing documents and websites
Code Attribution	Link malware to known threat actors or families
Incident Triage	Quickly prioritize and categorize detected threats

Key Teaching Point: Fuzzy similarity scores (0-100) provide evidence of structural relation, not absolute proof of malicious intent or definitive attribution. Thresholds must be tuned to the specific context of the investigation.

9.5 CFG Hashing and Import Hashing

Control Flow Graph (CFG) Hashing

Feature	Description
Structural Analysis	Maps basic blocks (nodes) and control flows like jumps/calls (edges)
Resilience	Survives instruction substitution, dead-code insertion, and minor code reordering
Clustering	Supports graph isomorphism and similarity analysis to group malware families
BinDiff Integration	Facilitates binary-level comparison between malware versions

Import Hashing (ImpHash)

Feature	Description
API Profile	Computes a hash based on the ordered list of imported libraries and functions
Efficiency	Rapidly groups PE (Portable Executable) malware samples from the same builder or campaign
Fingerprinting	Identifies common developer environments or malicious frameworks
Limitation	Dynamic imports (e.g., LoadLibrary/GetProcAddress) and obfuscation can hide API usage from static ImpHash analysis

PART 10: TECHNIQUE SELECTION MATRIX

Selecting the Optimal Integrity and Recovery Technique

Operational Requirement	Recommended Technique
Detect accidental data corruption (networks/storage)	CRC-32 / Adler-32 Checksums
Verify exact file integrity & known malware lookups	SHA-256 Cryptographic Hash
Ensure message integrity with authentication	HMAC (Keyed-Hash Message Authentication)
Verify file origin, integrity, and non-repudiation	Digital Signatures (Hash + Asymmetric)
Identify structurally similar malware variants	SSDEEP / TLSH (Fuzzy Hashing)
Analyze binary code structure and relationships	CFG Hashing / BinDiff
Group malware by API function call profiles	ImpHash (Import Hashing)
Maintain continuous service and availability	RAID / Clusters / 3-2-1 Backups

PART 11: KEY TAKEAWAYS

Disaster Recovery

BCP = Organizational resilience; DRP = Technical restoration
BIA is the foundation: without it, RTO/RPO decisions are guesswork
RTO + WRT ≤ MTD is the fundamental recovery constraint
Recovery strategies: Hot (fastest, costliest) → Warm → Cold (slowest, cheapest)
3-2-1-1-0 Rule: 3 copies, 2 media, 1 off-site, 1 immutable, 0 unverified

Fault Tolerance

Fault Tolerance = Zero downtime; High Availability = Minimized downtime; DR = Service restoration
RAID is NOT a backup: Protects against hardware failure only
RAID 5 (1 disk failure) vs RAID 6 (2 disk failures) vs RAID 10 (performance)
Clustering: Active-Passive (simple) vs Active-Active (complex, high throughput)

Detection Techniques

Signatures = Fast, precise, but blind to zero-day
Heuristics/Sandboxing = Detect unknown threats, but may have false positives
Cryptographic Hashes = Exact integrity verification (SHA-256 is standard)
MD5/SHA-1 are broken → Migrate to SHA-256 or SHA-3
Fuzzy Hashing (SSDEEP) = Detect similar/related files, not exact matches
Digital Signatures = Integrity + Authentication + Non-repudiation

DPDS Unit 2: Complete Concept Guide

TABLE OF CONTENTCopy Anchor Link

PART 1: DISASTER RECOVERY FUNDAMENTALSCopy Anchor Link

PART 2: RECOVERY METRICS AND TIERSCopy Anchor Link

PART 3: BACKUP STRATEGIESCopy Anchor Link

PART 4: FAULT TOLERANCECopy Anchor Link

PART 5: ANTI-MALWARE AND DETECTIONCopy Anchor Link

PART 6: SIGNATURE-BASED DETECTIONCopy Anchor Link

PART 7: CHECKSUMS AND ERROR DETECTIONCopy Anchor Link

PART 8: CRYPTOGRAPHIC HASHESCopy Anchor Link

PART 9: ADVANCED SIGNATURESCopy Anchor Link

PART 10: TECHNIQUE SELECTION MATRIXCopy Anchor Link

PART 11: KEY TAKEAWAYSCopy Anchor Link

PART 1: DISASTER RECOVERY FUNDAMENTALSCopy Anchor Link

1.1 Why Plan for the Worst?Copy Anchor Link

Defining a DisasterCopy Anchor Link

Types of DisastersCopy Anchor Link

Critical Planning PrinciplesCopy Anchor Link

The Recovery ParadoxCopy Anchor Link

1.2 Business Continuity vs. Disaster RecoveryCopy Anchor Link

1.3 Business Impact Analysis (BIA): The Planning FoundationCopy Anchor Link

The Six-Step BIA ProcessCopy Anchor Link

Impact DimensionsCopy Anchor Link

PART 2: RECOVERY METRICS AND TIERSCopy Anchor Link

2.1 Core Recovery MetricsCopy Anchor Link

The Fundamental Recovery ConstraintCopy Anchor Link

System Availability FormulaCopy Anchor Link

2.2 Availability and Recovery TiersCopy Anchor Link

2.3 Recovery Strategies and DRP LifecycleCopy Anchor Link

DRP Lifecycle PhasesCopy Anchor Link

Recovery Site TypesCopy Anchor Link

DRP Testing LadderCopy Anchor Link

2.4 Historical Case: Maersk NotPetya Recovery (2017)Copy Anchor Link

Incident OverviewCopy Anchor Link

The “Ghana Miracle”Copy Anchor Link

Strategic Security LessonsCopy Anchor Link

PART 3: BACKUP STRATEGIESCopy Anchor Link

3.1 The Strategic BalanceCopy Anchor Link

Key Strategic DecisionsCopy Anchor Link

Primary DriversCopy Anchor Link

3.2 Backup Types ComparedCopy Anchor Link

Backup Schedule StrategiesCopy Anchor Link

Full + Daily IncrementalCopy Anchor Link

Full + Daily DifferentialCopy Anchor Link

Comparison TableCopy Anchor Link

Continuous Data Protection (CDP) / Near-CDPCopy Anchor Link

3.3 The 3-2-1 and 3-2-1-1-0 RulesCopy Anchor Link

The Classic 3-2-1 RuleCopy Anchor Link

The Modern 3-2-1-1-0 RuleCopy Anchor Link

3.4 Backup Media and Location DecisionsCopy Anchor Link

Storage Media ComparisonCopy Anchor Link

Location & Disaster RiskCopy Anchor Link

3.5 Backup Verification ChecklistCopy Anchor Link

The Strategic MandateCopy Anchor Link

Recovery Success CriteriaCopy Anchor Link

PART 4: FAULT TOLERANCECopy Anchor Link

4.1 Fault Tolerance vs High Availability vs Disaster RecoveryCopy Anchor Link

Comparison FrameworkCopy Anchor Link

Failure Scope HierarchyCopy Anchor Link

4.2 Redundancy Layers & Single Points of FailureCopy Anchor Link

Power RedundancyCopy Anchor Link

Hardware RedundancyCopy Anchor Link

Network RedundancyCopy Anchor Link

Software RedundancyCopy Anchor Link

Data RedundancyCopy Anchor Link

Geographic RedundancyCopy Anchor Link

4.3 RAID Building BlocksCopy Anchor Link

RAID ConceptsCopy Anchor Link

RAID Is Not a BackupCopy Anchor Link

4.4 RAID LevelsCopy Anchor Link

RAID Level ComparisonCopy Anchor Link

The Hot Spare StrategyCopy Anchor Link

RAID 5 RisksCopy Anchor Link

RAID 6 AdvantagesCopy Anchor Link

4.5 High-Availability ClusteringCopy Anchor Link

Active-Passive ModelCopy Anchor Link

Active-Active ModelCopy Anchor Link

The Failover MechanismCopy Anchor Link

PART 5: ANTI-MALWARE AND DETECTIONCopy Anchor Link

5.1 Antivirus SoftwareCopy Anchor Link

TABLE OF CONTENT

PART 1: DISASTER RECOVERY FUNDAMENTALS

PART 2: RECOVERY METRICS AND TIERS

PART 3: BACKUP STRATEGIES

PART 4: FAULT TOLERANCE

PART 5: ANTI-MALWARE AND DETECTION

PART 6: SIGNATURE-BASED DETECTION

PART 7: CHECKSUMS AND ERROR DETECTION

PART 8: CRYPTOGRAPHIC HASHES

PART 9: ADVANCED SIGNATURES

PART 10: TECHNIQUE SELECTION MATRIX

PART 11: KEY TAKEAWAYS

PART 1: DISASTER RECOVERY FUNDAMENTALS

1.1 Why Plan for the Worst?

Defining a Disaster

Types of Disasters

Critical Planning Principles

The Recovery Paradox

1.2 Business Continuity vs. Disaster Recovery

1.3 Business Impact Analysis (BIA): The Planning Foundation

The Six-Step BIA Process

Impact Dimensions

PART 2: RECOVERY METRICS AND TIERS

2.1 Core Recovery Metrics

The Fundamental Recovery Constraint

System Availability Formula

2.2 Availability and Recovery Tiers

2.3 Recovery Strategies and DRP Lifecycle

DRP Lifecycle Phases

Recovery Site Types

DRP Testing Ladder

2.4 Historical Case: Maersk NotPetya Recovery (2017)

Incident Overview

The “Ghana Miracle”

Strategic Security Lessons

PART 3: BACKUP STRATEGIES

3.1 The Strategic Balance

Key Strategic Decisions

Primary Drivers

3.2 Backup Types Compared

Backup Schedule Strategies

Full + Daily Incremental

Full + Daily Differential

Comparison Table

Continuous Data Protection (CDP) / Near-CDP

3.3 The 3-2-1 and 3-2-1-1-0 Rules

The Classic 3-2-1 Rule

The Modern 3-2-1-1-0 Rule

3.4 Backup Media and Location Decisions

Storage Media Comparison

Location & Disaster Risk

3.5 Backup Verification Checklist

The Strategic Mandate

Recovery Success Criteria

PART 4: FAULT TOLERANCE

4.1 Fault Tolerance vs High Availability vs Disaster Recovery

Comparison Framework

Failure Scope Hierarchy

4.2 Redundancy Layers & Single Points of Failure

Power Redundancy

Hardware Redundancy

Network Redundancy

Software Redundancy

Data Redundancy

Geographic Redundancy

4.3 RAID Building Blocks

RAID Concepts

RAID Is Not a Backup

4.4 RAID Levels

RAID Level Comparison

The Hot Spare Strategy

RAID 5 Risks

RAID 6 Advantages

4.5 High-Availability Clustering

Active-Passive Model

Active-Active Model

The Failover Mechanism

PART 5: ANTI-MALWARE AND DETECTION

5.1 Antivirus Software

Definition