75 lines
4.5 KiB
Markdown
75 lines
4.5 KiB
Markdown
---
|
||
title: "Module 7 — Recovery & Resilience"
|
||
description: "Backup architecture review, immutable backup deployment, disaster recovery runbooks, tabletop exercise, and ASTRAL baseline as rebuild blueprint. Tested recovery, not assumed."
|
||
eyebrow: "Consulting Module"
|
||
lead: "The most common recovery lie in the industry: 'we have backups.' Having a backup is not the same as being able to recover. This module replaces the assumption with a tested, documented, and rehearsed capability — so when the incident happens, recovery is a procedure, not an improvisation."
|
||
actions:
|
||
- label: "Get in Touch"
|
||
url: "/about/#contact"
|
||
primary: true
|
||
- label: "View All Modules"
|
||
url: "/consulting/skills/"
|
||
---
|
||
|
||
## What It Delivers
|
||
|
||
<div class="feature-list">
|
||
<div class="feature-item">
|
||
<div class="feature-item-icon">🔍</div>
|
||
<div class="feature-item-body">
|
||
<h4>Backup Architecture Review</h4>
|
||
<p>Current backup coverage assessed for every workload: M365 data, on-premises systems, cloud VMs, and critical databases. The gaps that consistently appear — M365 data that employees believe Microsoft backs up but that has no independent point-in-time backup, backup systems reachable from the same network as production, backup credentials stored in the same password manager as everything else — are found and documented before an attacker finds them first.</p>
|
||
</div>
|
||
</div>
|
||
<div class="feature-item">
|
||
<div class="feature-item-icon">🧱</div>
|
||
<div class="feature-item-body">
|
||
<h4>Immutable Backup Deployment</h4>
|
||
<p>Immutable, off-network backup deployed for critical workloads. Ransomware operators delete or encrypt backups before they hit production — a backup reachable from the compromised estate is not a backup. Immutability ensures the backup cannot be modified or deleted even by a fully compromised admin account.</p>
|
||
</div>
|
||
</div>
|
||
<div class="feature-item">
|
||
<div class="feature-item-icon">📖</div>
|
||
<div class="feature-item-body">
|
||
<h4>Disaster Recovery Runbooks</h4>
|
||
<p>Step-by-step recovery procedures written for every critical workload — including the scenarios nobody documents: AD forest recovery, M365 tenant configuration restore, and cloud infrastructure rebuild from ASTRAL baseline. Each runbook is tested, not just written. A runbook that has never been executed is a hypothesis.</p>
|
||
</div>
|
||
</div>
|
||
<div class="feature-item">
|
||
<div class="feature-item-icon">🎯</div>
|
||
<div class="feature-item-body">
|
||
<h4>Tabletop Exercise</h4>
|
||
<p>A structured scenario walkthrough — typically a ransomware incident or identity compromise — run with the actual response team. Gaps in communication, decision authority, and technical procedure surface in a tabletop, not in a live incident. Every gap found in the exercise is a gap not found under pressure.</p>
|
||
</div>
|
||
</div>
|
||
<div class="feature-item">
|
||
<div class="feature-item-icon">🔀</div>
|
||
<div class="feature-item-body">
|
||
<h4>ASTRAL Baseline as Rebuild Blueprint</h4>
|
||
<p>The ASTRAL Git repository — capturing your M365 and Intune configuration — becomes your authoritative rebuild baseline. After a catastrophic configuration failure or tenant compromise, "what do we restore to?" has a deterministic answer. The restore pipeline applies the known-good state without manual reconstruction from memory.</p>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
## The Antifragile Recovery Principle
|
||
|
||
A robust organisation survives an incident and comes back the same. An antifragile one comes back different — with a shorter kill chain, a tested runbook it now knows works, and one more scenario it has rehearsed. Every incident that runs through this module's feedback loop makes the next one cheaper. The tabletop is not a compliance checkbox; it is the cheapest incident you will ever have.
|
||
|
||
## Scope and Prerequisites
|
||
|
||
| | |
|
||
|---|---|
|
||
| **Duration** | 30–60 days |
|
||
| **Environment** | M365 and/or on-premises |
|
||
| **Prerequisites** | ASTRAL deployed (Module 1 or 3) for the configuration baseline; inventory of critical workloads |
|
||
| **Natural follow-on** | Module 11 (Blue/Purple Team) to build the detection capability that feeds the recovery loop |
|
||
|
||
<div class="cta-strip">
|
||
<h2>Know you can recover before you need to</h2>
|
||
<p>An untested backup is simultaneously fine and worthless. Module 7 tells you which one yours is — before the incident does.</p>
|
||
<div class="actions">
|
||
<a href="/about/#contact" class="btn btn-primary">Get in Touch</a>
|
||
<a href="/consulting/skills/" class="btn btn-outline">View All Modules</a>
|
||
</div>
|
||
</div>
|