Business continuity, disaster recovery and ransomware readiness
You run a business impact analysis, set RTO and RPO, build 3-2-1 backup and recovery plans, and lead ransomware tabletop exercises.
Level 301 · 20 lessons · 18 practice labs
Lessons
Business continuity basics
- Business continuity and disaster recovery: the difference and the link: You can explain the difference between keeping the business running and bringing systems back, and how the two plans work together.
- Business impact analysis: finding critical processes: By interviewing process owners, you measure how much harm each outage causes and how quickly.
- RTO, RPO and maximum tolerable downtime: You set the acceptable downtime and data loss for each critical system and hand them to IT as targets.
- ISO 22301 and the continuity management system: You fit continuity work into the plan-do-check-act cycle of ISO 22301.
- Quick task: an impact sheet for three processes
Backup and recovery
- The 3-2-1 backup rule and immutable backups: You draw up a plan that strengthens the three-copies, two-media, one-offsite rule with immutable and offline backups.
- Protecting backups: separate identities, segregation, offline copies: You isolate the backup system with separate accounts and networks so a compromise of the main environment cannot reach it.
- Restore testing: a backup counts only if it restores: You plan regular restore tests and report measured times against the RTO target.
- DR options: hot, warm and cold sites: You can justify the right disaster recovery site option by balancing cost against recovery time.
- Quick task: restore from backup and verify checksums
Ransomware readiness
- How ransomware progresses and where it can be stopped: You can show the stages from initial access to encryption and the detection and blocking points for each.
- Preventive controls: patching, MFA, privilege management, endpoint protection: You prioritise the basic controls that cut ransomware risk most and identify the gaps in your organisation.
- A ransomware response playbook: You write step by step who does what in the first hours, which systems to isolate and how decisions are made.
- The payment question: legal, ethical and sanctions angles: You can present the sanctions, insurance, law enforcement and ethical sides of a ransom payment neutrally to leadership.
- Crisis communications: staff, customers, press, regulators: You prepare messages for each stakeholder, the approval flow and backup communication channels for an outage.
- Quick task: find the gaps in a playbook
Exercises and improvement
- Writing a continuity plan: roles, call tree, workarounds: You write a workable plan showing how work continues by hand without systems and who calls whom.
- Designing and running a tabletop exercise: You prepare and lead a tabletop exercise with objectives, scenario steps and surprise developments.
- After-action review and improvement plan: You turn gaps found in an exercise into an improvement plan with owners and dates.
- Capstone: build recovery priorities and a continuity plan for a logistics firm: You deliver a business impact analysis, backup strategy and ransomware response plan for a fictional company in one package.
Practice labs
- Rank processes by criticality: Rank ten processes as critical, important or deferrable from the given outage impact notes.
- An impact sheet for three processes: Fill in a sheet with financial, operational and reputational impact for a logistics firm's dispatch, billing and customer service processes.
- Recovery order from the impact analysis: From impact data on twelve Mavikaya Lojistik processes, derive a recovery order that respects dependencies, with target times.
- Check the 3-2-1 rule: Assess five backup set-ups against the 3-2-1 rule and the immutable copy criterion.
- Find the weak points of the backup set-up: In a backup architecture description, find the shared admin account, the repository on the same network and the missing offline copy.
- Write a backup protection design: Write a backup protection design for Karaçam Mobilya with separate identities, network segregation, immutable retention and an offline copy.
- Restore from backup and verify checksums: Restore an archive in the lab and compare the file checksums with the recorded values.
- Evaluate the restore test records: In a year of restore test records, report systems never tested, failed tests and times beyond the objective.
- Hot, warm, cold: pick an option: For three systems, choose a hot, warm or cold site by recovery objectives and budget and justify it.
- Match the control to the stage it stops: Match ten preventive controls, from the defender's side, to the initial access, spread or impact stage of a ransomware incident.
- Find the gaps in a playbook: Review a ransomware response playbook for isolation, decision authority, communication, evidence and recovery and list the gaps.
- A decision flow for the first four hours: Write the decisions, their owners and their order for the first four hours after encrypted servers are noticed at a manufacturer.
- Direct the message to the right audience: Match ten communication messages to staff, customers, press or regulators.
- An assessment note for the payment decision: Write a one-page note for management covering the legal, ethical and sanctions angles, the state of backups and the options.
- Write the crisis statements: Write three consistent statements for staff, customers and the press about an outage at Mercanköşk Otelcilik.
- Make the exercise objectives measurable: Rewrite six tabletop exercise objectives with an observable success measure.
- Design a tabletop exercise: Prepare a ninety-minute exercise on a ransomware scenario with participants, a timeline and five injects.
- An improvement plan after the exercise: From an exercise's observation notes, write a review with what worked, what failed and ten owned, dated actions.
About this course
You run a business impact analysis, set RTO and RPO, build 3-2-1 backup and recovery plans, and lead ransomware tabletop exercises.
What you will learn
- Business continuity basics
- Backup and recovery
- Ransomware readiness
- Exercises and improvement
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.