Glossary

155 terms from Resilience and Recovery, in plain words, each with the chapter that teaches it.

Search the glossary

#

3-2-1 rule: A backup rule: keep at least 3 copies of your data (the original and 2 backups), on 2 different types of storage, with 1 copy off site. The modern version adds that the off-site copy should be immutable or offline.

A

activation and notification: The first of NIST's three disaster recovery phases. The team assesses the damage, the person with authority declares a disaster, and everyone on the contact list is notified.
active-active: A cluster design where every node does work at the same time. If one node fails, the others take over its share, so each node needs room to carry extra load.
active-passive: A cluster design where one node does the work and another waits as a standby. When the active node's heartbeat stops, the standby takes over.
air gap: A backup copy with no network connection, such as a removed disk or a tape in a safe, so malware cannot reach it. CISA recommends offline, encrypted backups of critical data.
Amazon S3 (Simple Storage Service): Amazon Web Services' cloud object storage service, used to store files and backups. Its Object Lock feature can make backups immutable: they are stored write once, read many (WORM), so no one can change or delete them until a set retention period ends.
ASHRAE (American Society of Heating, Refrigerating and Air-Conditioning Engineers): An engineering body whose guidance sets safe conditions for server rooms. It recommends an inlet air temperature of 18 to 27°C and gives a humidity range.
asynchronous replication: Replication where a write finishes right away and the far copy is updated a moment later. It stays fast over long distances, but the last few seconds or minutes of changes can be lost.
automatic transfer switch (ATS): A switch that detects a power outage, starts the generator and moves the electrical load from utility power to the generator.
autoscaling: Automatically adding servers when demand rises and removing them when it falls, within a minimum, a maximum and a target such as 50% processor use. Alex sets the shop's autoscaler to a minimum of 2 and a maximum of 6.
availability: The "A" in the CIA triad: systems and data being usable when they are needed. It is measured as the share of time a system is up, and for a repairable system it equals MTBF ÷ (MTBF + MTTR).
AWS (Amazon Web Services): Amazon's cloud provider, which runs S3. AWS documents that in compliance mode, not even the root user can delete a locked object.

B

backup: A separate copy of data made at a known time and kept apart from the live system, so the data can be restored after it is lost, damaged or encrypted. RAID, replication and snapshots are not backups.
blackout: A total loss of power. A short blackout is bridged by a UPS; a long one needs a generator.
brownout: A period of low voltage, when power sags but does not stop completely. A UPS protects equipment through it.
business continuity (BC): Keeping the organization's essential work going during and after a disruption by any means, not only by restoring IT, for example by taking orders on paper forms. It includes disaster recovery.
business continuity plan (BCP): The written plan for sustaining an organization's mission and business processes during and after a disruption. It covers people, places, suppliers, communication and manual workarounds.
business impact analysis (BIA): The first step of continuity planning. It lists business functions, how much harm losing each one would do over time and what each depends on, and sets time limits such as the MTD, from which RTOs are set.

C

capacity planning: Making sure there are enough people, technology and infrastructure to meet demand now and in the future, including during a failure or disaster.
CIA triad (confidentiality, integrity and availability): The three core goals of security: confidentiality, integrity and availability. Resilience and recovery protect the availability part.
CISA (Cybersecurity and Infrastructure Security Agency): The US government's cybersecurity agency. Its #StopRansomware Guide warns that ransomware hunts for backups, recommends offline encrypted backups, and advises against paying the ransom.
cloud provider: A company that rents out computing, storage and services over the internet, usually in several separate regions. Kettle & Crane's shop runs on rented virtual servers at one.
cluster: A group of servers (nodes) that work together and look like one system to users. Clustering suits things that need one current set of data, such as a database, and moves work to another node when one fails.
cold site: A recovery site with space, power, cooling and network links but no working systems. Hardware must be obtained and data restored, so recovery takes days to weeks, but it is the cheapest option.
colocation: A data center that rents rack space, power and cooling while you bring your own equipment. It can serve as a recovery site.
compliance mode: An S3 Object Lock setting in which no user, not even the account's root user, can overwrite or delete a locked version until its retention period ends. It protected Kettle & Crane's cloud backups from the ransomware attacker.
contingency plan: A written plan for keeping a system running or restoring it after a disruption. NIST SP 800-34 is the US government's guide to writing one.
cross-training: Teaching more than one person each critical task, so no single person is a single point of failure. An example is Alex teaching Priya to run the shop failover.

D

DDoS (distributed denial-of-service): An attack in which many machines flood a service with traffic. It could make an autoscaler add servers without end, so set a sensible maximum and add DDoS protection.
declare a disaster: The formal decision by the person with authority, such as Morgan, that an event is a disaster, which starts the recovery plan. Declaring early saves recovery time.
defense in depth: Using several different layers of protection so that one failure or flaw does not defeat everything. Platform diversity is one form of it.
degraded: The state of a redundant RAID set that has lost a disk but still works. After you replace the disk, the set rebuilds the missing data and has no spare protection until the rebuild finishes.
differential backup: A backup that copies everything changed since the last full backup. It grows each day, but a restore needs only the last full backup plus the latest differential.
disaster: An event big enough that normal fixes are not enough, such as a fire, flood, long regional power cut or ransomware that encrypts most systems. A single failed server is not a disaster; redundancy should handle it.
disaster recovery (DR): The plans and actions that restore IT systems and data after a major disruption, often at a recovery site. It is one part of business continuity.
disaster recovery plan (DRP): The written plan for restoring a system or facility after an emergency, often at an alternate site. It covers who decides, who is called, the restore order, step-by-step instructions and how to return to the primary site.
DNS (Domain Name System): The system that turns names such as shop.kettleandcrane.com into addresses. During a failover it is changed to point users at the working site, a step that slowed Alex's September test.
dual ISPs: Two internet links from two different internet service providers, so a failure at one provider does not cut off the site.

E

environmental considerations: The physical conditions around a site that can stop its systems: location, natural hazards, power, cooling, humidity, fire, water and physical access.

F

failback: Switching work back from the backup system or recovery site to the repaired primary site after a failover.
failover: Moving work from a failed part or site to a working one, for example a standby node taking over when the active node's heartbeat stops.
failover test: A planned test that really switches production to the backup systems or site, such as Alex moving the shop to its second region. It is the only test that proves the switch works, and it carries the most risk.
fault tolerant: Able to keep working with no interruption at all when a part fails, for example with mirrored parts or redundant power supplies. It costs more than high availability, which allows a short pause.
firmware: The small program built into a device that controls it. A firmware bug affects every device of that model, which is a reason for hardware diversity.
full backup: A backup that copies everything in scope. It is the slowest and largest to make, but the simplest and fastest to restore.

G

GBIC (Gigabit Interface Converter): An older, larger plug-in transceiver for switch and server ports. It is hot-swappable, and the SFP replaced it.
geographic dispersion: Spreading sites across regions far enough apart that one flood, storm, earthquake or grid failure cannot hit them all. It is why Alex moved the warm site from the nearby roastery to another state.
governance mode: An S3 Object Lock setting that lets specially permitted users bypass the lock. It is useful for testing but weaker than compliance mode.
grandfather-father-son (GFS): A retention scheme that keeps recent daily backups (sons), fewer weekly ones (fathers) and a few monthly or yearly ones (grandfathers). Alex keeps 7 dailies, 4 weeklies and 12 monthlies on the NAS.

H

hardware diversity: Not relying on identical physical parts from one maker, model or batch, so a batch defect, firmware bug or supply shortage cannot take out every copy at once.
health check: A small test request that a load balancer sends to each server every few seconds. Servers that fail it are taken out of the pool until they answer again.
heartbeat: A small regular signal that cluster nodes send each other. If it stops for a set time, the cluster treats the node as down and fails over.
high availability (HA): A system that stays usable for an agreed, very high share of time, such as 99.9%. It recovers from failures automatically with only a short pause, using redundant parts, automatic failover and monitoring.
host: The physical machine that runs a hypervisor and its virtual machines. If a host fails, every VM on it is affected unless important VMs are spread over several hosts.
hot site: A fully working copy of the primary site, with hardware, software and continuously replicated data. It can take over in minutes to hours and is the most expensive option.
hot-swappable: Able to be replaced while the device keeps running, like most server power supplies and SFP modules.
hypervisor: The software layer that lets one physical host run several virtual machines. Using different hypervisors means one hypervisor bug cannot stop every server.

I

IEC 62040-3: The International Electrotechnical Commission standard that classes UPS designs by how much their output depends on the input: VFD (standby), VI (line-interactive) and VFI (online).
immutability: A backup that nobody can change or delete until its retention period ends. It is the strongest defense against ransomware that deletes backups.
incremental backup: A backup that copies only what changed since the last backup of any kind. It is fast and small, but a restore needs the last full backup plus every incremental since, in order.
ISO 22301: The international standard for running a business continuity program.

J

joule rating: How much energy a surge protector can absorb before it wears out. A higher joule rating is better.
journaling: Writing a record of each change to a log (the journal) before or as the change is made. It lets file systems recover cleanly after a crash, and some products use it to roll data back to any point in time.

K

Kubernetes: A common platform for running containers. Its autoscaler picks how many replicas to run with desiredReplicas = ceil[currentReplicas × (currentMetricValue ÷ desiredMetricValue)], where ceil means round up, so 3.6 becomes 4.

L

least connections: A load balancer scheduling method that sends the next request to the server with the fewest open connections.
lessons learned: The review at the end of an event or test that records what worked and what did not, and updates the plan.
line-interactive UPS: A UPS that works like a standby unit but also corrects small voltage dips and rises without using its battery. It is common in small server rooms; Alex installs one for the order server.
load balancer: A device or service in front of a pool of identical servers that spreads requests across them and skips servers that fail health checks.

M

maintainability: How quickly something can be fixed after it fails. MTTR measures it, and a lower MTTR is better.
manual workaround: A non-computer way to keep essential work going while systems are down, such as Priya taking café orders by phone on paper forms. It is part of business continuity, not disaster recovery.
maximum tolerable downtime (MTD): The longest a business function can be unavailable before the harm becomes unacceptable. It is set in the business impact analysis, and a system's RTO must be shorter than it.
Mbps (megabits per second): A unit of network speed: millions of bits per second. Because a byte is 8 bits, a 400 GB (gigabyte) backup takes about 8.9 hours over a 100 Mbps link even at full speed.
mean time between failures (MTBF): The average time a repairable system runs between one failure and the next: total operating time ÷ number of failures. A higher MTBF means better reliability.
mean time to failure (MTTF): The average time until a part fails once, used for parts that are replaced rather than repaired, such as a fan or a disk you throw away.
mean time to repair (MTTR): The average time from a failure to the system working again: total repair time ÷ number of repairs. A lower MTTR is better.
mobile site: A self-contained recovery site in a trailer or shipping container that is driven to where it is needed. It is usually set up like a warm site.
monoculture: Everything built the same way. It is easy to manage, but one bug, bad update or attack can hit every copy at once; it is the opposite of platform diversity.
multicloud: Using two or more different cloud providers, so an outage, account loss or lock-in at one provider does not stop the service. The cost is more complexity.

N

N+1: A capacity rule: if the peak needs N servers, UPS units or cooling units, have one more spare, so any one can fail at the busiest time without an outage.
NAS (network-attached storage): A small file server on the office network. Kettle & Crane keeps its first backup copy on one.
NFPA 110: The US National Fire Protection Association's standard for emergency power systems. A Type 10 system restores power within 10 seconds, and diesel generators must be exercised under load at least monthly for at least 30 minutes.
nginx: A widely used web server that can also act as a load balancer, spreading requests across a pool of servers such as Kettle & Crane's shop servers. The command `nginx -t` checks a configuration for errors without applying it.
NIC (network interface card): The part in a server that connects it to the network. A single NIC is a single point of failure.
NIC teaming: Making two or more NICs in one server act as one connection, for failover or load sharing, ideally with each cabled to a different switch.
nines: Shorthand for availability percentages: three nines is 99.9% (8.76 hours of downtime a year) and four nines is 99.99% (52.6 minutes). Each extra nine cuts allowed downtime by ten.
NIST SP 800-34: Special Publication 800-34 from the US National Institute of Standards and Technology (NIST), the US government's guide to contingency planning, meaning how to keep a system running or restore it after a disruption. It is a standard source for the definitions of hot, warm and cold recovery sites, recovery phases, and recovery targets such as RTO and RPO.

O

object lock: A cloud storage feature that locks stored objects so they cannot be changed or deleted for a set period, making backups immutable.
off-site storage: Storage somewhere other than the main building, such as a vault or cloud provider. It survives the loss of the site but is slower to restore from.
on-site storage: Storage in the same building as the systems. It is fast to restore from but can be lost in the same fire or flood.
online UPS: A UPS whose equipment always runs on power the UPS has converted to direct current (DC) and back again, fed by the batteries when wall power fails. It has no switchover gap and gives clean output, but costs the most.

P

parallel processing: A test that runs the recovery systems on the same real work as production at the same time and compares the results, while production stays in charge. Some sources also use the term for several systems sharing one job so a failed one can be dropped.
parity: Extra data calculated from the rest of the data that can rebuild one lost piece. RAID 5 and RAID 6 use it.
platform diversity: Deliberately using different vendors, hardware or software where one shared flaw would otherwise stop everything. A platform is the base a system runs on, such as its operating system, hardware, cloud service or virtualization software.
pool: The group of servers doing the same job behind a load balancer.
power distribution unit (PDU): A rack's power strip, often managed remotely; racks often get separate A and B feeds, each to its own PDU, so one failed feed stops only one side. A PDU spreads power but does not store it, so it is no substitute for a UPS.
power generator: A machine that makes electricity from fuel such as diesel for as long as the fuel lasts, covering long outages. It needs seconds to start, so a UPS bridges the gap.
power supply unit (PSU): The part inside a server that turns wall power into the low voltages the computer uses.
primary site: The organization's main location where its systems normally run.

Q

quorum: A cluster rule that a node may act only if it can reach more than half of the cluster's members, so only one side of a broken link can win. It prevents split brain.
quota: A cloud provider's limit on how many resources an account may use. A recovery plan that needs more servers than the quota allows will fail.

R

RAID (redundant array of independent disks): Combining several physical disks to act as one, usually so the data survives a failed disk. RAID is not a backup: it copies deletions and ransomware to every disk.
RAID levels (0, 1, 5, 6, 10): RAID layouts: RAID 0 stripes with no redundancy; RAID 1 mirrors to two disks; RAID 5 stripes with parity and survives one failed disk. RAID 6 uses double parity and survives two, and RAID 10 stripes mirrored pairs.
ransomware: Malware that encrypts or locks files and demands payment. It attacks availability and often hunts for backups first.
reciprocal agreement: An agreement between two organizations to host each other's systems after a disaster. It is cheap but hard to enforce, and both may be hit by the same event.
reconstitution: The third NIST recovery phase: repair the primary site, move work back to it (failback), and close the event with lessons learned.
recovery: Getting a system back to normal after it has stopped. In NIST's three-phase plan, the recovery phase restores systems in planned order and comes after activation and notification and before reconstitution.
recovery point objective (RPO): How much data, measured in time, you can afford to lose, counted back from the disruption to the last good copy. The backup interval must be equal to or shorter than it.
recovery site: A second place where an organization can run its systems when the primary site cannot be used. It can be hot, warm or cold.
recovery time objective (RTO): The longest a system may take to be restored after a disruption, measured forward from the disruption. It is set by the business, must be shorter than the MTD, and drives the choice of site.
redundancy: Having more than one of something, so that if one fails another carries on.
redundant power supply (RPS): Two or more PSUs in one server, either able to run it alone. It protects against a failed power part inside the server, not a building power cut.
reliability: How rarely something breaks. MTBF measures it, and a higher MTBF is better.
repairable system: A system or part that is fixed and put back into service when it fails, such as a server or a printer. MTBF and MTTR describe repairable systems; MTTF is for parts that are replaced.
replica: One running copy of an application, the unit an autoscaler adds or removes.
replication: Copying data to another storage system, usually in another place, as it changes. It keeps a hot site current but also copies mistakes and ransomware.
resilience: The ability of a system to keep working, perhaps more slowly, when part of it fails.
restoration testing: Actually restoring a backup to a separate place on a schedule, checking it is complete (for example with hashes) and works, and timing it.
restore point: The moment a backup or snapshot captured, which is the point in time you can return data to. After an attack, pick the newest clean restore point from before the attacker arrived, not simply the newest backup.
retention: How long each backup is kept before it is deleted, which decides how far back you can restore. It balances detection time, legal rules and cost.
round robin: A load balancer scheduling method that sends requests to each server in turn: 1, 2, 3, 1, 2, 3. It is nginx's default.

S

SaaS (software as a service): Software hosted and run by a provider, such as email or a shop platform. Many SaaS providers do not promise to restore your deleted data, so include that data in backup scope.
scaling out: Adding more servers to handle demand, which is what autoscaling usually does.
scaling up: Making one server bigger, with more processors or memory.
scheduling method: The rule a load balancer uses to decide which server gets the next request, such as round robin, least connections or weighted.
scope: What a backup includes (data, systems, configurations, SaaS data, keys) and how much is copied each time (full, incremental or differential).
service credit: A small refund a provider gives when it misses its SLA. It does not bring lost sales back.
service level agreement (SLA): A contract that states what service a provider must deliver, such as 99.9% availability a month.
session persistence: Keeping one customer on the same server for a whole visit, for example while a shopping cart is filled.
SFP (Small Form-factor Pluggable): A small hot-swappable transceiver module that replaced the GBIC. Keeping spares on the shelf turns a failed module into a fix of minutes, not days.
sha256sum: A Linux command that makes a SHA-256 hash (fingerprint) of each file. With -c it checks files against a saved list of hashes and reports OK or FAILED.
simulation: A realistic rehearsal where people really perform their recovery tasks in a safe copy of the situation, without switching production. It finds gaps in the plan and in people's knowledge.
single point of failure (SPOF): Any one part whose failure stops the whole service, such as a single firewall in front of three web servers, or the only person who knows how to restore a system.
snapshot: A record of a disk, volume or VM at one moment that you can roll back to, which is handy before a risky change. It usually lives on the same storage, so it is not a backup.
split brain: When the link between cluster nodes breaks, each thinks the other has died, and both act as active and write data, which can corrupt it.
standby UPS: The cheapest UPS design. Equipment runs on wall power, and the UPS switches to battery only when power fails, with a gap of a few milliseconds.
surge: A sudden, very short rise in voltage, for example from lightning, that can destroy electronics.
surge protector: A device that limits how much extra voltage from a surge reaches equipment by sending the excess to ground. It does nothing in an outage.
synchronous replication: Replication where a write is not finished until both copies have it, so no completed write is lost if the first site fails. Every write waits for the far copy, so the sites must be fairly close.
system image: A complete copy of a disk, including the operating system and applications, that can be restored to new hardware or run as a VM.

T

tabletop exercise: A meeting where people talk through a disaster scenario step by step without touching any systems.
tar: A standard Linux archiving tool: -czf creates a compressed archive, and -xzf extracts one into the folder given by -C.
transceiver: A small plug-in module that converts electrical signals to light, or to the signal a cable needs, and back, for a switch or server port.

U

UL 1449: The US standard from Underwriters Laboratories used to test surge protectors.
uninterruptible power supply (UPS): A battery box between wall power and equipment that keeps it running through short cuts and brownouts, usually for minutes. That gives time for a generator to start or servers to shut down cleanly.
upstream: An nginx block that defines a pool of servers to balance traffic across; max_fails=3 fail_timeout=30s stops traffic to a server for 30 seconds after 3 failures within 30 seconds. A server marked backup gets traffic only when the others are unavailable.
USB (Universal Serial Bus): A common connector for plug-in devices. Jo's backups go to a USB disk, which is on site and can be lost with the server.

V

vendor lock-in: Being stuck with one supplier, so its outage, collapse or price rise leaves you no other option.
vendor platform diversity: Using products or providers from more than one vendor for the same job, so one vendor's flaw, bad update or outage cannot stop everything. Alex's second backup provider is an example.
versioning: Keeping old versions of a file when it is changed or deleted. It is not a backup on its own, but combined with a deletion lock it is very strong.
virtual machine (VM): A computer run as software on a host, with its own operating system. Because it is a set of files, it can be copied, backed up and started on another host.
virtualization: Running computers as software on a hypervisor. It helps resilience because VMs restart on other hosts and restore quickly, but many VMs share one host's fate.
voltage protection rating (VPR): The UL 1449 rating of how much voltage a surge protector lets through in the test surge. A lower number means better protection.

W

warm site: A recovery site with space and some or all hardware, but not current systems and data. Recovery takes hours to days at moderate cost; Kettle & Crane's is a switched-off cloud VM in another state.
weighted: A load balancer scheduling method where bigger servers get a bigger share of requests, set by a number called a weight.
WORM (write once, read many): Storage that can be written once and then only read, not changed, for a set period. S3 Object Lock works this way.