InfoSec Notes
HubCybersecurity vs Information SecurityHistory of Information SecurityImportance of Information SecuritySecurity Principles and the CIA TriadWhat is Information Security?Accountability in Information SecurityAuthentication in Information SecurityAuthorization in Information SecurityAvailability in Information SecurityConfidentiality in Information SecurityIntegrity in Information SecurityNon-Repudiation in Information SecurityAES - Advanced Encryption StandardAsymmetric Key CryptographyDES - Data Encryption StandardDigital SignaturesEncryption vs DecryptionCryptographic Hash FunctionsIntroduction to CryptographyPublic Key Infrastructure (PKI)RSA AlgorithmSymmetric Key CryptographyIntroduction to Access ControlAttribute-Based Access Control (ABAC)Discretionary Access Control (DAC)Mandatory Access Control (MAC)Role-Based Access Control (RBAC) — Information SecurityZero Trust Security ArchitectureFirewalls in Network SecurityIntrusion Detection Systems (IDS)Intrusion Prevention Systems (IPS)Network Monitoring and AnalysisNetwork Security BasicsSecure Network DesignVirtual Private Networks (VPN)Wireless Network SecurityAPI SecurityIntroduction to Application SecuritySecurity Code ReviewDependency and Supply Chain SecurityDynamic Application Security Testing (DAST)Secure Software Development LifecycleStatic Application Security Testing (SAST)Web Authentication MechanismsCross-Site Scripting (XSS)Cross-Site Request Forgery (CSRF)File Upload SecurityHTTPS and SSL/TLSSecure Coding Practices — Information SecuritySession Management SecuritySQL Injection Attacks and PreventionIntroduction to Web SecurityOS Access Control ModelsEndpoint SecurityFile System Permissions and SecurityLinux SecurityIntroduction to OS SecurityUser Account ManagementWindows SecurityCloud Security FundamentalsCloud Security Best PracticesContainer Security — Information SecurityData Security in the CloudCloud Identity and Access ManagementKubernetes SecurityShared Responsibility Model — Information SecurityIntroduction to Digital ForensicsDisk ForensicsDigital Evidence CollectionDigital Forensic ToolsIncident Investigation ProceduresMemory ForensicsNetwork ForensicsContainment StrategiesDetection and Analysis PhaseEradication and RecoveryIntroduction to Incident ResponseIncident Response LifecycleIncident Response PlaybooksPost-Incident Review and Lessons LearnedBusiness Continuity PlanningDisaster Recovery PlanningRisk Assessment MethodologyIntroduction to Risk ManagementSecurity ControlsThreat ModelingVulnerability AssessmentCompliance ManagementGDPR Data Protection OverviewISO 27001 Information Security ManagementNIST Cybersecurity FrameworkSecurity Audits and AssessmentsSecurity GovernanceSecurity Policies and StandardsCloud Security Interview QuestionsCryptography Interview QuestionsInformation Security CheatsheetInformation Security Interview QuestionsNetwork Security Interview QuestionsGlossary of Information Security TermsImportant Security Concepts ReferenceRecommended Books and Learning ResourcesSecurity Tools OverviewIncident Response LabLog Analysis ProjectNetwork Monitoring ProjectPassword Manager ProjectSecure Login System ProjectVulnerability Scanner ProjectInsider ThreatsMalware Types and AnalysisPhishing Attacks and PreventionRansomware AttacksSecurity Threats OverviewSocial Engineering AttacksSpyware and Surveillance SoftwareTrojan Horse MalwareComputer VirusesNetwork Worms
Understanding the availability principle of the CIA Triad, including redundancy strategies, disaster recovery, DDoS protection, and ensuring systems remain accessible to authorized users when needed.
Understanding Availability
Availability ensures that information systems and data are accessible to authorized users when needed. It is the third pillar of the CIA Triad and addresses business continuity — even the most secure system is useless if legitimate users cannot access it.
Availability is measured in terms of uptime percentage:
| Availability Level | Downtime Per Year | Downtime Per Month | Common Name |
|---|---|---|---|
| 99% | 3.65 days | 7.31 hours | "Two nines" |
| 99.9% | 8.76 hours | 43.8 minutes | "Three nines" |
| 99.99% | 52.56 minutes | 4.38 minutes | "Four nines" |
| 99.999% | 5.26 minutes | 26.3 seconds | "Five nines" |
| 99.9999% | 31.5 seconds | 2.63 seconds | "Six nines" |
Threats to Availability
Natural Threats
- Earthquakes, floods, hurricanes
- Power outages
- Hardware failures (disk crashes, memory errors)
Human-Caused Threats
- Denial of Service (DoS/DDoS) attacks
- Ransomware encrypting critical systems
- Accidental deletion or misconfiguration
- Insider sabotage
Technical Threats
- Software bugs causing crashes
- Resource exhaustion (memory leaks, disk full)
- Network congestion or failures
- Cascading failures in distributed systems
Strategies for Ensuring Availability
1. Redundancy
Redundancy Patterns
=======================
Active-Active (Load Balanced)
Client → [Load Balancer] → Server A (active)
→ Server B (active)
→ Server C (active)
All servers handle traffic simultaneously
Active-Passive (Failover)
Client → Server A (active/primary)
Server B (standby/passive) ← monitors A
If A fails: Server B becomes active (automatic failover)
N+1 Redundancy
Need N servers to handle load
Deploy N+1 servers (one spare)
Any single failure is tolerated
Geographic Redundancy
Region A (US-East) ←→ Region B (US-West) ←→ Region C (EU-West)
Data replicated across regions
DNS routes to nearest healthy region
2. RAID Storage
RAID Level Comparison
========================
RAID 0 (Striping)
[Disk 1: A1,A3,A5] [Disk 2: A2,A4,A6]
↑ Performance, ✗ No redundancy
RAID 1 (Mirroring)
[Disk 1: A1,A2,A3] [Disk 2: A1,A2,A3] (exact copy)
↑ Redundancy, ↓ Storage efficiency (50%)
RAID 5 (Striping + Distributed Parity)
[Disk 1: A1,A3,Px] [Disk 2: A2,Py,A5] [Disk 3: Pz,A4,A6]
Tolerates 1 disk failure, good balance
RAID 6 (Double Parity)
Tolerates 2 simultaneous disk failures
Recommended for large arrays
RAID 10 (Mirroring + Striping)
[Mirror 1: D1a,D1b] [Mirror 2: D2a,D2b]
Best performance + redundancy, expensive
3. Backup Strategies
Example
from datetime import datetime, timedelta
class BackupStrategy:
"""Implement grandfather-father-son backup rotation."""
def __init__(self):
self.backup_schedule = {
"daily": {"retention": 7, "type": "incremental"},
"weekly": {"retention": 4, "type": "differential"},
"monthly": {"retention": 12, "type": "full"},
"yearly": {"retention": 7, "type": "full"}
}
def calculate_rpo_rto(self, system_criticality: str) -> dict:
"""Calculate Recovery Point and Recovery Time Objectives."""
objectives = {
"critical": {
"RPO": "< 1 hour (minimal data loss)",
"RTO": "< 15 minutes",
"strategy": "Real-time replication + hot standby",
"backup_frequency": "Continuous (synchronous replication)"
},
"high": {
"RPO": "< 4 hours",
"RTO": "< 1 hour",
"strategy": "Asynchronous replication + warm standby",
"backup_frequency": "Every hour"
},
"medium": {
"RPO": "< 24 hours",
"RTO": "< 4 hours",
"strategy": "Daily backups + cold standby",
"backup_frequency": "Daily"
},
"low": {
"RPO": "< 7 days",
"RTO": "< 24 hours",
"strategy": "Weekly backups + rebuild from scratch",
"backup_frequency": "Weekly"
}
}
return objectives.get(system_criticality, objectives["medium"])
def three_two_one_rule(self):
"""Implement the 3-2-1 backup rule."""
return {
"3": "Keep at least 3 copies of data",
"2": "Store copies on 2 different media types",
"1": "Keep 1 copy offsite (geographically separate)",
"extended_3-2-1-1-0": {
"extra_1": "1 copy offline (air-gapped)",
"0": "0 errors (verified backups)"
}
}
backup = BackupStrategy()
critical_system = backup.calculate_rpo_rto("critical")
print(f"Critical System Objectives:")
for key, value in critical_system.items():
print(f" {key}: {value}")
4. DDoS Protection
| CDN / Edge Layer | ← Geographic distribution, caching |
|---|---|
| (Cloudflare/AWS) | Absorbs volumetric attacks |
| Rate Limiting | ← Throttle excessive requests |
| & WAF | Block known attack patterns |
| Load Balancer | ← Distribute across servers |
| (Auto-scaling) | Scale up during attacks |
| Application | ← CAPTCHA, request validation |
| Layer Protection | Bot detection, IP reputation |
| Origin Servers | ← Only clean traffic reaches here |
5. High Availability Architecture
Example
import time
import random
class HighAvailabilityCluster:
"""Simulate a high-availability cluster with health checks."""
def __init__(self, nodes: list):
self.nodes = {node: {"status": "healthy", "load": 0} for node in nodes}
self.primary = nodes[0]
self.heartbeat_interval = 5 # seconds
def health_check(self, node: str) -> bool:
"""Check if a node is responding."""
# Simulate occasional failures
return random.random() > 0.05 # 95% uptime per node
def failover(self, failed_node: str):
"""Automatic failover when primary fails."""
self.nodes[failed_node]["status"] = "failed"
# Find next healthy node
for node, info in self.nodes.items():
if info["status"] == "healthy" and node != failed_node:
self.primary = node
print(f"FAILOVER: {failed_node} → {node}")
print(f" New primary: {node}")
return node
print("CRITICAL: No healthy nodes available!")
return None
def calculate_cluster_availability(self, node_availability: float,
num_nodes: int) -> float:
"""Calculate overall cluster availability."""
# Probability all nodes fail simultaneously
all_fail = (1 - node_availability) ** num_nodes
cluster_availability = 1 - all_fail
return cluster_availability
# Example: 3-node cluster
cluster = HighAvailabilityCluster(["node-1", "node-2", "node-3"])
# Single node: 99.9% availability
single_node = 0.999
# 3-node cluster availability
cluster_avail = cluster.calculate_cluster_availability(single_node, 3)
print(f"Single node availability: {single_node*100:.3f}%")
print(f"3-node cluster availability: {cluster_avail*100:.7f}%")
print(f"Improvement: {(1-single_node)*365*24:.1f}h → {(1-cluster_avail)*365*24*60:.2f}min downtime/year")
Real-World Availability Incident: AWS US-East-1 Outage (2021)
What happened: On December 7, 2021, AWS experienced a major outage in the US-East-1 region affecting hundreds of services including Disney+, Netflix, Slack, and many others.
Root cause: A network configuration change caused unexpected behavior in the internal network, creating congestion that cascaded through dependent services.
Impact: ~5 hours of degraded service affecting millions of users.
Lessons learned:
- Avoid single-region architectures for critical services
- Implement multi-region failover
- Design for graceful degradation
- Test disaster recovery regularly
Availability Monitoring
python example
import time
from datetime import datetime
class AvailabilityMonitor:
"""Monitor system availability and calculate SLA metrics."""
def __init__(self, service_name: str, sla_target: float = 99.99):
self.service_name = service_name
self.sla_target = sla_target
self.incidents = []
self.total_minutes_monitored = 0
self.total_downtime_minutes = 0
def record_incident(self, start: datetime, end: datetime, cause: str):
"""Record a downtime incident."""
duration = (end - start).total_seconds() / 60
self.incidents.append({
"start": start,
"end": end,
"duration_minutes": duration,
"cause": cause
})
self.total_downtime_minutes += duration
def calculate_availability(self, period_minutes: int) -> dict:
"""Calculate availability percentage for a period."""
uptime = period_minutes - self.total_downtime_minutes
availability = (uptime / period_minutes) * 100
sla_met = availability >= self.sla_target
return {
"service": self.service_name,
"period_minutes": period_minutes,
"uptime_minutes": uptime,
"downtime_minutes": self.total_downtime_minutes,
"availability": f"{availability:.4f}%",
"sla_target": f"{self.sla_target}%",
"sla_met": sla_met,
"incidents": len(self.incidents)
}Interview Questions
- What is the difference between RPO and RTO?
- RPO (Recovery Point Objective) defines the maximum acceptable data loss measured in time — how far back you can tolerate losing data. RTO (Recovery Time Objective) defines the maximum acceptable downtime — how quickly systems must be restored. Both drive backup and disaster recovery strategies.
- How would you protect a web application against DDoS attacks?
- Layer approach: CDN for edge distribution, rate limiting, Web Application Firewall, auto-scaling infrastructure, geographic load balancing, IP reputation filtering, CAPTCHA for suspicious requests, and having a DDoS response plan with ISP cooperation.
- Explain the 3-2-1 backup rule.
- Keep at least 3 copies of data, stored on 2 different types of media (e.g., disk + tape or disk + cloud), with 1 copy stored offsite. Modern extensions add 1 offline/air-gapped copy and 0 errors (verified backups).
- What is the difference between high availability and fault tolerance?
- High availability aims to minimize downtime but accepts brief interruptions during failover (seconds to minutes). Fault tolerance ensures zero downtime with no interruption — the system continues operating normally even when components fail (achieved through redundant active components).
- A company requires 99.99% availability. How many minutes of downtime is allowed per month?
- 99.99% availability allows 0.01% downtime. In a 30-day month (43,200 minutes): 43,200 × 0.0001 = 4.32 minutes of downtime per month maximum.
Summary
Availability is often the most visible aspect of security — users immediately notice when systems are down but may never know about confidentiality or integrity breaches. Ensuring availability requires a comprehensive approach combining redundancy, disaster recovery planning, DDoS protection, monitoring, and regular testing of recovery procedures.
Exam Focus
Revise definitions, diagrams, examples, and short-answer points for Availability in Information Security.
Interview Use
Prepare one clear explanation, one practical example, and one common mistake for this Information Security topic.
Search Terms
information-security, information security, information, security, fundamentals, availability, availability in information security
Related Information Security Topics
Continue learning this concept
Security FundamentalsAccountability in Information SecurityUnderstanding accountability principles in information security including audit trails, logging, monitoring, non-repudiation mechanisms, and how to establish responsibility for security actions.Security FundamentalsAuthentication in Information SecurityComplete guide to authentication mechanisms including passwords, multi-factor authentication, biometrics, tokens, and modern passwordless approaches for verifying user identity.Security FundamentalsAuthorization in Information SecurityUnderstanding authorization mechanisms, access control models, permission systems, and the principle of least privilege for controlling what authenticated users can do within systems.Security FundamentalsConfidentiality in Information SecurityDeep dive into the confidentiality principle of the CIA Triad, exploring encryption methods, access controls, data classification, and practical implementations to protect sensitive information from unauthorized disclosure.Security FundamentalsIntegrity in Information SecurityComprehensive guide to the integrity principle of the CIA Triad, covering hash functions, digital signatures, checksums, database integrity, and techniques to detect and prevent unauthorized data modification.Security FundamentalsNon-Repudiation in Information SecurityUnderstanding non-repudiation as a security service that provides undeniable proof of origin, delivery, or action, covering digital signatures, timestamps, and legal frameworks.