4.4. Resilience and Recovery in Security Architecture
💡 First Principle: Security architecture must assume failures will happen — hardware fails, attacks succeed, natural disasters strike. Resilience is the ability to continue operating through failures; recovery is the ability to restore normal operations after failures. Without both, a single incident can destroy the organization. The question isn't "will we have an incident?" — it's "can we survive one?"
What does failure to plan for resilience look like? A company runs its entire operation from a single data center. A power outage takes everything offline for 18 hours. No backup site, no failover, no continuity plan. Revenue lost, customer trust damaged, regulatory fines for violating SLA commitments. Every hour of that outage was preventable with proper resilience architecture.
Unlike other security domains (which focus on preventing and detecting attacks), resilience focuses on what happens after something goes wrong. It's the safety net that makes all other controls less critical in isolation — because even when prevention fails, the organization survives.
Think of the site options on a spectrum: a hot site is the fastest to fail over to but the most expensive to maintain, while a cold site is the cheapest but slowest to bring online.
⚠️ Exam Trap: Hot site means fastest recovery at the highest cost; cold site means slowest recovery at the lowest cost — the exam tests whether you can match a stated RTO requirement to the right site type.
