Resilience and Recovery by Design: The Architect's Share of Recoverability

All courses / The Transformed Security Architect / Module 2 / Chapter 11

Learning objectives

After the lesson the participant can:

• Distinguish the architect's share of recoverability from the operators' share.
• Specify completeness, integrity and provenance, separation and order for the known-good definitions of a system.
• Draft a recovery definition for an AI system with degraded modes and named people who decide to resume.
• Plan a reversibility test for a delegated function with acceptance criteria written beforehand.

Key concepts

Recoverability

The measured ability to carry out a recovery plan. Recovery time and point objectives are requirements on the architecture, each met by a design decision and shown by a test; an objective no design can meet is a finding for the risk owner.

Known-good definitions

The definitions from which a system is redeployed, which must be complete, signed with provenance the deployment path verifies, held with their keys outside the blast radius, and ordered in a dependency graph checked for cycles.

Recovered AI system

One shown to behave as it did before the incident, not merely one that is running. It needs a known-good source for every component or a design that needs none, an index rebuild path, pinned and replaceable provider components, and evaluation before return.

Degraded mode

A predefined configuration the organisation can switch to without a change process: a lower autonomy level, fewer functions or a manual procedure, for every AI system whose function the organisation cannot afford to lose.

Fallback manifest

A designed artefact that names the fallback procedure, the people who must be able to perform it, the interfaces it needs and the date it last ran. A scheduled check confirms links resolve, people still hold role and access, and the last exercise is within its interval.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The chapter says the pipeline cannot restart what a person stopped. What would be lost and what protected if your organisation adopted that rule for its agents?
2. An annual test cannot catch an erosion that begins the week after it. Which fallback in your organisation was last performed by people who are still in role?
3. A platform that deliberately disturbs controls is among the most dangerous systems an organisation can run. Which of the chapter's safety boundaries would you insist on before a first experiment?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. What does Hansa's recovery definition RCV-HM-CTA-01 do with the claims-triage agent's memory and pending actions?

   1. It restores both from the last evidence bundle and replays the queue automatically
   2. It discards the memory and freezes pending actions for review, with no automatic replay
   3. It keeps the memory and lets the pipeline replay the queue after evaluation
   4. It archives both with the supplier until the supervisor has been informed
   Show the answer

   B. It discards the memory and freezes pending actions for review, with no automatic replay
   The definition sets memory to discard and pending actions to frozen, reviewed by the operator rota in Poland, with autoReplay false. A new workload identity is issued and the old credentials are not restored.

2. What did the architect at Nordvik Region find when rehearsing the manual degraded mode with a benefits team that had not taken part in the live exercise?

   1. That the hosting provider could not deliver replacement accelerators within four hours
   2. That the fallback called the same provider as the system it replaced
   3. That the stop path took 26 minutes against a budget of 15
   4. That only two caseworkers still remembered how to work without the ranking
   Show the answer

   D. That only two caseworkers still remembered how to work without the ranking
   Only two caseworkers still remembered how to work without the ranking. The finding extends the test for delegation DEL-NR-BEN-01 and becomes a change to the induction programme and a fallback manifest checked weekly.

3. Why is Level 4 Autonomous not used for recovery at all, according to the chapter?

   1. Because DORA Article 12 names the level and prohibits it for restoration
   2. Because recovery tooling cannot hold an identity of its own
   3. Because Level 4 is never used for irreversible actions, and recovery contains some
   4. Because chaos experiments must first reach 20 safe runs in production
   Show the answer

   C. Because Level 4 is never used for irreversible actions, and recovery contains some
   Level 4 Autonomous is never used for irreversible actions, and because recovery contains some, it is not used for recovery at all. A system returned to service starts at a lower level and regains its level only after renewed approval.