L1 Week 5: Data Privacy, Incident Response, Forensics, Risk Management, Resilience & Physical Security

Playlist: Security+ 42-End

---

1. Data Privacy and Data Sensitivity Concepts

Data has value beyond just confidentiality — how it’s classified, who owns it, and what regulations apply to it determine both legal exposure and the controls required to protect it. This section covers the governance side of data security: roles, classification, and the specific data types that carry regulatory weight.

1.1 Privacy vs. Security

Security controls protect the CIA triad (confidentiality, integrity, availability) of a processing system. Privacy is a separate governance requirement that applies specifically when personal data is collected and processed.

Aspect	Data Security	Privacy
Focus	CIA of the processing system	Rights of the data subject
Scope	All information assets	Personal data (identifiable individuals)
Requirements	Encryption, access control, availability	Lawful collection, retention limits, subject access/removal rights

Exam tip: if a question describes an individual’s right to review or delete data held about them, that’s a privacy control, not a security control — even though encryption and access control support both.

1.2 Data Roles and Responsibilities

A data governance policy assigns institutional roles across the data life cycle.

Role	Responsibility
Data owner	Senior/executive role; ultimate accountability for CIA of the asset
Data steward	Data quality — labeling, metadata, regulatory-compliant collection/storage
Data custodian	Manages the storage system — access control, encryption, backup/recovery
Data Privacy Officer (DPO)	Oversight of PII assets managed by the company

1.3 Data Classification

Two overlapping schema types are tested:

By confidentiality level:

Classification	Description
Public (unclassified)	No viewing restrictions; risk is in modification/availability, not disclosure
Confidential (secret)	Sensitive; viewable only by approved persons or NDA-bound third parties
Critical (top secret)	Too valuable to risk capture; severely restricted viewing

By information type:

Type	Description
Proprietary	Owned by the company — products/services info
Private/personal	Relates to an individual’s identity
Sensitive	Personal data that could harm the individual if disclosed

1.4 Data Types

Data Type	Description	Notes
PII	Identifies, contacts, or locates an individual (SSN, name, DOB, email, phone, address, biometrics)	SSN alone can be unique; other fields uniquely identify only in combination. A static IP can be PII; a dynamically assigned ISP IP may not be.
PHI	Medical/insurance records, lab results	Can be anonymized/deidentified for research. High black-market value; permanent effect on breach — unlike a credit card number, it can’t be reissued.
Financial	Bank/investment accounts, payroll, tax returns, payment card data	PCI DSS governs card data handling. CVV and PIN should never both be stored; PIN should never be transmitted to/handled by the merchant.
Government	Citizen/taxpayer data collected by agencies	Sharing with companies requires strict security/privacy agreements

Exam gotcha: a data breach = any unauthorized read/modify/delete of data (including corporate IP). A privacy breach = specifically the loss/disclosure of personal and sensitive data. These are not interchangeable terms on the exam.

1.5 Data States and Protection

Data at Rest      → persistent storage (DB, archives, docs)
                     → whole-disk / DB / file-folder encryption + ACLs

Data in Transit    → moving across a network (web, remote access, cloud sync)
                     → TLS / IPSec

Data in Use         → volatile memory (RAM, CPU cache/registers)
                     → decrypted during processing; protected via TEE
                        (e.g., Intel SGX) to keep it encrypted even in memory

1.6 Data Exfiltration — Vectors and Mitigations

Exfiltration Vector	Mitigation
Removable media (USB, camera memory card, phone)	Encrypt data at rest; restrict removable media use
Network protocol (HTTP, FTP, SSH, email, IM)	Restrict allowed egress channels; disconnect archival systems from network
Oral/telephone/VoIP/SMS	User training on confidentiality
Image/video encoding of text data	Hard to detect via automated tools — training + DLP content inspection

Additional baseline mitigations: encrypt sensitive data at rest so exfiltrated data is useless without the key, maintain offsite backups against destruction/ransom, and train users on document confidentiality.

1.7 Data Loss Prevention (DLP)

DLP automates discovery/classification of data types and enforces rules against unauthorized viewing or transfer.

Component	Function
Policy server	Configures classification/confidentiality/privacy rules, logs incidents, compiles reports
Endpoint agents	Enforce policy on client machines, even offline
Network agents	Scan traffic at network borders; interface with web/messaging servers

---

2. Performing Incident Response

Incident response converts a security event into a managed, documented process that limits damage and preserves organizational reputation. This section covers the lifecycle, the frameworks used to describe attacker behavior, and the data sources analysts pull from during an investigation.

2.1 Incident Response Lifecycle

Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned
      ^                                                                     |
      └─────────────────────────────────────────────────────────────────────┘

Phase	Activity
Preparation	Harden systems, write policies/procedures, set up secure comms, build IR resources
Identification	Triage alerts/reports, determine if an incident occurred, assess severity, notify stakeholders
Containment	Limit scope/magnitude; secure data while minimizing customer/partner impact
Eradication	Remove the cause; restore secure configuration and patches
Recovery	Reintegrate system into business process; restore from backup; heightened monitoring
Lessons Learned	Document and analyze; feed improvements back into Preparation

Exam tip: the cycle isn’t strictly linear — response may iterate through identification → containment → eradication → recovery multiple times before full resolution.

Reference: NIST SP 800-61r2 (Computer Security Incident Handling Guide).

2.2 CIRT and the IR Plan

The response team is called a CIRT (Cyber Incident Response Team), CSIRT (Computer Security Incident Response Team), or CERT (Computer Emergency Response Team) — often housed within a SOC.

• First responder — the trained person who takes charge when a suspicious event is detected. All employees need enough training to recognize and escalate.
• Incident response plan (IRP) — lists procedures, contacts, and resources per incident category (DDoS, malware outbreak, external exfiltration, internal data modification, etc.).
• Playbook/runbook — a data-driven SOP for a specific threat scenario (phishing, SQLi exfiltration, block-listed IP connection). Starts from a SIEM detection query and defines detection → containment → eradication steps.

2.3 Cyber Kill Chain

1. Reconnaissance   → gather info on personnel, systems, supply chain
2. Weaponization     → couple payload with exploit code
3. Delivery           → transmit weaponized code (email attachment, USB)
4. Exploitation       → code executes (phishing click, drive-by download)
5. Installation       → remote access tool persists on target
6. Command & Control  → outbound channel to attacker infrastructure
7. Actions on Objectives → data exfiltration or other attacker goals

2.4 Other Attack Frameworks

Framework	Model
MITRE ATT&CK	Database of known TTPs, each with a unique ID, tagged to tactic categories (initial access, persistence, lateral movement, C2, etc.). Sequence between categories is not prescribed.
Diamond Model of Intrusion Analysis	Analyzes an intrusion event (E) via four vertices: Adversary, Capability, Infrastructure, Victim

            Adversary
            /        \
   Infrastructure — Capability
            \        /
             Victim

Exam tip: Cyber Kill Chain is sequential and attacker-centric; MITRE ATT&CK is a non-sequential TTP catalog; the Diamond Model is relationship-centric (four vertices, not stages). Know which one a question is describing by whether it mentions “stages,” “TTP IDs,” or “relationships between adversary/victim.”

2.5 Data Sources for Incident Response

SIEM (Security Information and Event Management) parses and normalizes log/traffic data from multiple sensors and hosts, then runs correlation rules to flag events for investigation.

Error.LogonFailure > 3 AND LogonFailure.User AND Duration < 1 hour

A single failed logon isn’t alertable; multiple failures for the same account within an hour is a correlation-rule candidate. SIEMs are also fed threat intelligence to match observed indicators (IPs, domains) against known threat actors.

• Incident handler’s dashboard — uncategorized events assigned to the analyst, plus status visualizations.
• Manager’s dashboard — overall status metrics across all handlers.

Logging platforms:

Platform	Notes
Syslog	Open format/protocol for event logging; UDP 514; used by routers, switches, servers, workstations
journalctl / journald	systemd-managed Linux hosts write binary journald logs (can forward to syslog format)
NXlog	Normalizes Windows XML-format logs into syslog format

OS and network log categories (Windows):

Log	Content
Application	Events from applications/services
Security	Audit events — failed logons, denied file access
System	OS/service events (e.g., storage volume health)
Setup	Windows installation events
Forwarded Events	Events sent from other hosts

Other key sources: network appliance system + traffic/access logs, authentication logs (RADIUS, TACACS+, AD), vulnerability scan reports (correlated against known exploits), DNS event logs (query types, contact with suspicious domains, lookup-failure anomalies), and web/HTTP access logs.

HTTP Status Range	Meaning
4xx	Client-based error (e.g., repeated 403 = unauthorized access attempts)
5xx	Server-based error (e.g., 502 Bad Gateway = upstream comms blocked/down)

2.6 Containment, Eradication, and Recovery

Containment Type	Mechanism
Isolation-based	Remove the affected component entirely — pull the network plug/air gap, disable switch port, sandbox VM, disable a user account or app service
Segmentation-based	Use VLANs/routing/subnets/firewall ACLs to confine hosts to a protected segment — can be configured as a sinkhole/honeynet to deceive the attacker while enabling reverse engineering

Exam tip: disconnecting a host completely is the least stealthy containment option and reduces opportunity for attack analysis — segmentation/sinkholing preserves analysis capability.

Eradication and recovery steps:

1. Reconstitute affected systems — remove malicious files/tools or restore from secure backups/images.
2. Reaudit security controls to close the exploited vector (and any newly discovered ones).
3. Notify affected parties and provide remediation guidance (e.g., password rotation elsewhere).

2.7 Firewall Configuration Changes

Post-incident hardening typically means tightening egress filtering, not just ingress rules — internal hosts infected by other means still need to be blocked from reaching C2 infrastructure.

• Allow only authorized application ports; restrict destinations to authorized hosts where possible.
• Restrict DNS lookups to your own/ISP DNS or authorized public resolvers (Google, Quad9).
• Block known-bad IP ranges and unauthorized IP space.
• Block all internet access from subnets that don’t need it (internal servers, ICS management workstations).

---

3. Explaining Digital Forensics

Digital forensics is the discipline of collecting and documenting evidence to a standard admissible in court. Unlike general incident response, every action here must be defensible under legal scrutiny — chain of custody and repeatability matter as much as the technical findings.

3.1 Key Aspects and Documentation

Digital evidence is latent — like DNA or fingerprints, it can’t be seen with the naked eye and must be interpreted via a machine/process. Forensic investigations most often arise from insider threats: fraud or equipment misuse.

Ethical principles for forensic analysis:

• Performed without bias.
• Conclusions drawn only from the direct evidence under analysis.
• Methods must be repeatable by third parties given the same evidence.
• Evidence should ideally not be changed or manipulated.

A digital forensics report summarizes the significant contents of the data and the investigator’s conclusions.

3.2 E-Discovery

A full forensic exam of a drive covers all Electronically Stored Information (ESI) — allocated and unallocated sectors. E-discovery filters that raw output down to the relevant evidence and stores it in a trial-usable database format.

3.3 Scene Documentation, Witnesses, and Timelines

• The crime scene is documented with photographs, and ideally audio/video, capturing every action taken during identification, collection, and handling of evidence.
• Notes are essential — trial may occur months or years after the event.
• In-place CCTV or webcam footage can be valuable corroborating evidence.
• A timeline is the chronological visual representation of events, built by correlating file system/OS timestamps. The benchmark reference time is UTC (Coordinated Universal Time).

Exam tip: always normalize timestamps to UTC when building a forensic timeline — local time zone artifacts are a common source of investigative error.

3.4 Event Logs and Network Traffic as Evidence

Digital evidence extends beyond host memory/drives to network appliance and server event logs, plus packet captures/flow data. Most networks don’t log all traffic by default (data volume); organizations with sufficient resources may choose to preserve much more.

---

4. Summarizing Risk Management Concepts

Risk management ties technical vulnerabilities to business consequences — it’s the framework that justifies why a control gets funded. This section covers the process itself, the ways risk is measured, and business continuity metrics used to plan for worst-case events.

4.1 Risk Management Process

1. Identify mission essential functions
2. Identify vulnerabilities
3. Identify threats
4. Analyze business impacts (likelihood × impact)
5. Identify risk response

Effective risk management focuses first on functions whose failure would threaten the whole business, since mitigation spend is finite.

4.2 Risk Types

Type	Description
External	Threat actors and wider risks (natural disasters, pandemics) — the most critical impacts involve risk to life/safety
Internal	Risks from owned/managed assets and workflows, including temporarily-access-granted contractors
Multiparty	An adverse event impacting multiple organizations, typically via supplier relationships
IP theft	Loss of commercially valuable owned data (copyrighted work, patents, designs); exfiltration destroys much of its value
Software compliance/licensing	EULA violations can expose the organization to fines
Legacy systems	No longer patched; maintenance expertise is scarce

4.3 Risk Assessment: Quantitative vs. Qualitative

Quantitative assigns concrete monetary values:

SLE (Single Loss Expectancy) = Asset Value × Exposure Factor (EF)
ARO (Annualized Rate of Occurrence) = expected occurrences per year
ALE (Annualized Loss Expectancy) = SLE × ARO

Qualitative skips dollar figures and ranks based on opinion/categorization:

Category	Examples
Asset value	Irreplaceable, High Value, Medium Value, Low Value
Risk frequency	One-off, Recurring
Risk probability	Critical, High, Medium, Low

4.4 Risk Response Options

Response	Description
Avoidance	Stop the risk-bearing activity entirely — rarely a credible option due to business impact
Transference (sharing)	Assign risk to a third party (insurance, outsourced contract with defined liability)
Acceptance (tolerance)	No countermeasures deployed (cost not justified, or delay unavoidable) — risk must still be monitored, not ignored
Mitigation	(implied baseline) Deploy countermeasures to reduce likelihood/impact

Exam gotcha: “acceptance” does not mean “ignore.” The exam distinguishes accepted-and-monitored risk from risk that’s simply neglected.

4.5 Business Impact Analysis (BIA)

BIA assesses potential losses across threat scenarios — e.g., quantifying lost orders and customer churn from a 5-hour DDoS outage on an e-commerce portal, annualized to determine whether a mitigation (load balancing, managed DDoS protection) is cost-justified.

4.6 Mission Essential Functions — Continuity Metrics

Metric	Definition
MTD (Maximum Tolerable Downtime)	Longest outage a function can sustain before irrecoverable business failure. Varies by function/company (minutes–hours for critical, 24h for urgent, 7 days for normal).
RTO (Recovery Time Objective)	Time an IT system may remain offline post-disaster — time to identify the problem + perform recovery (restore/failover)
WRT (Work Recovery Time)	Additional time after systems recovery to reintegrate systems, test functionality, and brief users

MTD ≥ RTO + WRT   (recovery must complete within the tolerable downtime window)

4.7 Single Points of Failure (SPoF)

A SPoF is any asset whose failure takes down the entire workflow; mitigated via redundant components.

Metric	Applies To	Formula
MTTF (Mean Time To Failure)	Non-repairable assets (e.g., a hard drive)	Total time ÷ number of devices
MTBF (Mean Time Between Failures)	Repairable assets (e.g., a server)	Total time ÷ number of failures
MTTR (Mean Time To Repair)	Time to restore full operation after a fault	Feeds directly into RTO

Worked example: 10 devices run for 50 hours, 2 fail.

MTBF = (10 × 50) / 2  = 250 hours
MTTF = (10 × 50) / 10 = 50 hours

Exam tip: MTTF = non-repairable, single-unit lifespan. MTBF = repairable-system reliability across failures. Don’t swap the formulas — the numerator is the same, the denominator (devices vs. failures) is what changes.

4.8 Disasters and Disaster Recovery Plans

A disaster is an event threatening mission essential functions (e.g., a data center destroyed by earthquake) — distinct from an incident like a privacy breach, which is critical but not necessarily a direct threat to business functions. Disasters can be internal/external, person-made, or environmental.

A Disaster Recovery Plan (DRP) should:

1. Identify disaster scenarios (natural and non-natural) and protection options.
2. Identify tasks, resources, and responsibilities for disaster response.
3. Train staff on procedures and adaptive response.

---

5. Implementing Cybersecurity Resilience

Resilience is about keeping a system running (or getting it back quickly) when a component fails — a different concern from preventing the failure in the first place. This section covers the two main levers: building redundancy into power, network, and disk layers, and backing up data so it can be restored.

5.1 High Availability

Availability is the percentage of time a system is online, measured over a defined period (typically one year). High availability is loosely described as 24x7 or 24x365. Critical systems are described by their number of “nines”:

Availability	Annual Downtime
99% (two-nines)	87:36:00
99.9%	08:45:36
99.99%	00:52:34
99.999%	00:05:15
99.9999% (six-nines)	00:00:32

Exam tip: more nines = exponentially less tolerable downtime. Memorize the shape of the table (each extra nine roughly divides downtime by 10), not just the endpoints.

5.2 Redundancy Strategies

Power redundancy — voltage spikes/surges and blackouts can crash or fail equipment. An enterprise-class server/appliance typically has two or more power supply units (PSUs); a hot plug PSU can be swapped without powering down the system.

Network redundancy:

Mechanism	Function
NIC teaming (adapter teaming)	Multiple NICs/ports on a server, each on separate cabling — combines bandwidth in normal operation (e.g., four 1 Gb ports = 4 Gb) and keeps the link up (at reduced bandwidth) if one NIC/cable fails
Load balancing switch	Distributes workload across available servers
Load balancing cluster	Redundant servers share data/session state to maintain consistent service during failover

Disk redundancy — backups provide integrity if a disk fails, but restoring from backup means installing new storage, restoring data, and testing configuration — slow. RAID (Redundant Array of Independent Disks) lets multiple disks act as backups for each other so the server keeps running if one (or more) disks fail, without a restore cycle.

Exam gotcha: RAID is not a backup. It protects availability against a single disk failure; it does nothing against accidental deletion, corruption, or ransomware that replicates across the array. Backups are still required.

5.3 Backup Strategies

Backups are the foundation of every business continuity and disaster recovery plan. Because storage isn’t limitless, backup frequency and retention must be governed by policy, balancing storage cost against the required recovery window.

Type	Data Selected	Backup / Restore Time	Archive Attribute
Full	All selected data, regardless of when previously backed up	High / Low (one tape set)	Cleared
Incremental	New files + files modified since the last backup (of any type)	Low / High (multiple tape sets)	Cleared
Differential	All new/modified files since the last full backup	Moderate / Moderate (no more than two sets)	Not cleared

Assuming a backup runs every working day:

• Incremental — fastest to back up, slowest to restore. Restore requires the last full backup plus every incremental since, applied in order.
• Differential — slower to back up as the week progresses (it re-copies everything since the full each time), but restore only needs the last full backup plus the most recent differential.

Exam tip: the archive attribute is the tell — full and incremental backups clear it (marking the file “already backed up”), differential does not (so each differential grows until the next full). If a question asks which type keeps re-including the same changed file every night, that’s differential.

Lab reference: Lab 27 — Backing Up and Restoring Data in Windows and Linux.

---

6. Explaining Physical Security

Physical security controls extend the same access-control fundamentals used in networks and operating systems into the physical world: they restrict and monitor access to buildings, server rooms, data centers, and other areas holding valuable hardware or information. Deciding where to invest requires a cost–benefit analysis against applicable regulations.

6.1 Physical Access Control Fundamentals

Physical controls map onto the same AAA model as logical access control:

Function	Physical Implementation
Authentication	Access lists and identification mechanisms that let approved persons through a barrier
Authorization	Barriers built around a resource so access is only possible through defined entry/exit points
Accounting	Records of when entry/exit points are used, to detect security breaches

6.2 Site Layout, Fencing, and Lighting

• Barricades and entry/exit points — no barricade is completely effective (walls can be climbed, locks picked); their real purpose is to channel people through defined, authenticated entry points backed by surveillance.
• Fencing — should be transparent (guards can see attempts to breach it), robust (hard to cut), and tall/topped with razor wire (hard to climb). Trade-off: effective fencing tends to make a building look intimidating.
• Lighting — contributes to perceived safety and acts as a deterrent by easing surveillance (camera or guard). Design must balance overall light levels, lighting of surfaces for tasks like facial recognition, and avoiding shadow/glare zones.

6.3 Gateways and Locks

Lock Type	Mechanism
Physical (conventional)	Key-operated; more expensive types resist picking better
Electronic (cipher/combination/keyless)	PIN entered on a keypad
Smart lock	Magnetic swipe card or proximity reader detecting a token (key fob, smart card)
Biometric	Thumbprint or other biometric scanner

A secure gateway should be self-closing and self-locking — never dependent on the user remembering to lock it.

Mantraps — a simple door/gate can’t reliably record who entered, since users can prop doors or an unauthorized person can tailgate behind an authorized one. Mitigations:

• A turnstile — allows only one person through at a time.
• A mantrap — one gateway leads into an enclosed space guarded by a second barrier, often paired with surveillance.

6.4 Alarm Systems

Entry points vulnerable to misuse (emergency exits, windows, hatches, grilles) may be fitted with bars, locks, or alarms:

Alarm Type	Trigger
Circuit alarm	Sounds when a circuit is opened or closed
Motion detection alarm	Triggered by movement within an area
Noise detection alarm	Triggered by sounds picked up by a microphone

6.5 Security Guards and Cameras

Control	Strength	Drawback
Security guards	Monitor checkpoints, verify ID, apply judgment/intuition, strong visual deterrent	Expensive
CCTV	Cheaper than staffing every gateway; records movement/access	Slower response time; effectiveness depends on enough staff monitoring feeds

6.6 Secure Areas — Host Security Controls

• Air gapped host — not physically connected to any network; the surrounding empty, closely monitored area serves the same function as a network DMZ.
• Safe — stores portable devices/media (backup tapes, USB drives holding encryption keys).
• Vault — a room hardened against unauthorized entry by physical force (drilling, explosives).

6.7 Secure Data Destruction

Physical security also covers the disposal phase of the data life cycle — media sanitization and remnant removal for hard drives, flash drives/SSDs, tape, and optical media before disposal or repurposing, plus secure disposal of paper documents.

• Deleting a file on a magnetic HDD (or a standard Windows format) only marks sectors as available for reuse — the data itself remains until overwritten.
• Overwriting is the standard HDD sanitization method, usually via drive firmware tools or a dedicated utility.
• Zero filling (single pass, all zeros) is the most basic method but can leave recoverable patterns under specialist forensic tools.
• A more secure approach uses three passes: all zeros → all ones → a pseudorandom pattern.

Exam tip: single-pass zero filling ≠ secure erasure. If a question emphasizes forensic-resistant sanitization, look for multi-pass overwriting (or degaussing/physical destruction, covered elsewhere) rather than a single zero-fill pass.

---

7. Quick Review / Exam Cheat Sheet

IR Lifecycle

Preparation → Identification → Containment → Eradication → Recovery → Lessons Learned → (back to Preparation)

Cyber Kill Chain

Recon → Weaponization → Delivery → Exploitation → Installation → C2 → Actions on Objectives

Data protection by state

At Rest    = encryption (disk/DB/file) + ACLs
In Transit = TLS / IPSec
In Use     = TEE (e.g., Intel SGX)

Risk formulas

SLE = Asset Value × EF
ALE = SLE × ARO
MTBF = Total Time / Number of Failures   (repairable assets)
MTTF = Total Time / Number of Devices    (non-repairable assets)
MTD ≥ RTO + WRT

Data Roles

Role	Owns
Data owner	Overall CIA accountability
Data steward	Data quality/labeling/compliance
Data custodian	System/storage management
DPO	PII oversight

Data Classification (confidentiality)

Level	Access
Public	Unrestricted viewing
Confidential	Approved persons / NDA third parties
Critical	Severely restricted

Data Types

Type	Key Fact
PII	Identifies an individual; context-dependent (static IP = PII, dynamic IP ≠)
PHI	Cannot be reissued once breached — permanent damage
Financial	PCI DSS governs card data
Government	Federal data-sharing agreements required

Attack Frameworks

Cyber Kill Chain = sequential attacker stages (7 steps)
MITRE ATT&CK     = non-sequential TTP catalog, tagged by tactic
Diamond Model     = relationship model: Adversary–Capability–Infrastructure–Victim

Containment Types

Isolation-based     = remove component entirely (air gap, disable account/port)
Segmentation-based  = confine via VLAN/routing/ACL (can become a sinkhole/honeynet)

Risk Responses

Avoidance     = stop the activity
Transference  = shift risk to third party (insurance/contract)
Acceptance    = no controls, but monitored
Mitigation    = deploy countermeasures

Log/Data Sources

Source	Port/Format
Syslog	UDP 514
journald	systemd binary log (Linux)
NXlog	Normalizes Windows XML logs → syslog
Windows Event Logs	Application / Security / System / Setup / Forwarded Events

High Availability — Nines

99%       = 87:36:00 downtime/yr
99.9%     = 08:45:36
99.99%    = 00:52:34
99.999%   = 00:05:15
99.9999%  = 00:00:32

Redundancy

Power  = dual/hot-plug PSUs
Network = NIC teaming (bandwidth + failover) / load balancing switch / load balancing cluster
Disk   = RAID (survives disk failure without a restore cycle — NOT a substitute for backups)

Backup Types

Full         = everything, every time            → clears archive bit
Incremental  = changed since LAST backup (any)    → clears archive bit  → fast backup, slow restore
Differential = changed since LAST FULL backup     → does NOT clear bit  → slow(er) backup, fast restore

Physical Security — AAA

Authentication = access lists / ID mechanisms at the barrier
Authorization  = barriers + defined entry/exit points
Accounting     = logs of entry/exit point use

Lock Types

Physical   = key
Electronic = PIN / cipher / combination / keyless
Smart      = swipe card or proximity token
Biometric  = fingerprint/thumbprint scanner

Anti-Tailgating Controls

Turnstile = one person through at a time
Mantrap   = gateway → enclosed space → second barrier (+ surveillance)

Data Sanitization (HDD)

Zero fill (1 pass)        = basic, pattern-recoverable with specialist tools
Zero + Ones + Random (3x) = more secure overwrite standard

Must-Know Acronyms

ACL   – Access Control List
ALE   – Annualized Loss Expectancy
ARO   – Annualized Rate of Occurrence
ATT&CK – Adversarial Tactics, Techniques, and Common Knowledge (MITRE)
BIA   – Business Impact Analysis
C2    – Command and Control
CCTV  – Closed Circuit Television
CERT  – Computer Emergency Response Team
CIA   – Confidentiality, Integrity, Availability
CIRT  – Cyber Incident Response Team
CSIRT – Computer Security Incident Response Team
DLP   – Data Loss Prevention
DPO   – Data Privacy Officer
DRP   – Disaster Recovery Plan
EF    – Exposure Factor
ESI   – Electronically Stored Information
EULA  – End User Licensing Agreement
HA    – High Availability
IP    – Intellectual Property
IR    – Incident Response
IRP   – Incident Response Plan
MTBF  – Mean Time Between Failures
MTD   – Maximum Tolerable Downtime
MTTF  – Mean Time To Failure
MTTR  – Mean Time To Repair
NIC   – Network Interface Card
PCI DSS – Payment Card Industry Data Security Standard
PHI   – Personal/Protected Health Information
PII   – Personally Identifiable Information
PSU   – Power Supply Unit
RAID  – Redundant Array of Independent Disks
RTO   – Recovery Time Objective
SIEM  – Security Information and Event Management
SLE   – Single Loss Expectancy
SOC   – Security Operations Center
SPoF  – Single Point of Failure
SSN   – Social Security Number
TEE   – Trusted Execution Environment
TTP   – Tactics, Techniques, and Procedures
UTC   – Coordinated Universal Time
WRT   – Work Recovery Time