Security and Disaster Recovery
Controls
Physical controls include locked racks, badge access and mantraps, cameras, BIOS/UEFI passwords, disabling boot from removable media, TPM, Secure Boot, and chassis intrusion detection. Logical controls include least privilege, RBAC, MFA, account lockout, ACLs, and separation of duties. Data controls include encryption at rest and in transit (TLS, IPsec), PKI and certificates, key management, data classification, and PII handling. Harden servers by removing unused roles and services, closing unused ports, patching on a schedule, and enforcing a known baseline. Network defenses include firewalls, DMZs, VLAN segmentation, IDS/IPS, and VPNs.
Incidents
Follow the incident response lifecycle: preparation, identification, containment, eradication, recovery, and lessons learned. Preserve evidence with a documented chain of custody; isolate a compromised host from the network rather than immediately powering it off if volatile memory matters.
Disaster recovery
RTO is how long until service is restored; RPO is how much data loss is tolerable, which drives backup frequency. A full backup captures everything; an incremental captures changes since the last backup of any type (restore needs the full plus every incremental); a differential captures changes since the last full (restore needs the full plus the latest differential). Apply the 3-2-1 rule: three copies, two media types, one offsite. DR sites are hot (near-instant), warm (partially equipped), or cold (space and power only). Test with tabletop exercises and failover drills, and follow retention and legal-hold requirements.
Traps: swapping RTO and RPO; describing a differential as "changes since the last backup"; assuming a hot site needs no configuration or testing; treating RAID or replication as a substitute for backup.
Worked example: the business tolerates 15 minutes of lost data and 4 hours of downtime, so RPO = 15 minutes (replicate or back up at least every 15 minutes) and RTO = 4 hours (a warm site with a tested 4-hour failover).