# What Is Disaster Recovery (DR)? Recovery Sites and DR Scenarios

**URL:** https://securesys.com.tr/en/learning/backup-and-business-continuity/what-is-disaster-recovery-dr-scenarios

![What Is Disaster Recovery (DR)? Recovery Sites and DR Scenarios](/images/bilgi-merkezi/covers/cover-backup-08.webp)

The existence of a backup in an organization does not mean that organization can keep operating during a disaster.

Backup protects the data.

However, from a business continuity perspective, more is most often needed.

For example, what happens if the main data centre becomes completely unusable?

The servers may have intact backups.

But;

the data centre has lost power,

the network infrastructure has been damaged,

the storage is unusable,

a fire has broken out,

a city-wide outage has occurred

or a major ransomware incident may have taken place.

In that case simply having the backup file is not sufficient.

The organization must be able to run its critical systems again on another infrastructure.

It is at this point that the:

#### Disaster Recovery – DR

that is:

#### Recovery from Disaster

concept comes into play.

Disaster Recovery is the whole of the technical, operational and managerial processes that enable information technology systems to be brought back into operation within an acceptable time and data loss level after a serious interruption or disaster.

DR is not merely a second data centre.

It also;

plans,

procedures,

technology,

personnel,

network,

replication,

backup,

testing,

failover

and failback

consists of these processes.

### What Is Disaster Recovery?

Disaster Recovery is the recovery approach that enables an organization's critical IT systems to be brought back into service after a major interruption.

This interruption;

a natural disaster,

fire,

flood,

earthquake,

a long-lasting power outage,

a storage failure,

a network problem,

ransomware,

a cyber attack,

human error

can arise from many causes such as these.

The core goal of DR is:

**running critical business systems again within acceptable RPO and RTO values.**

### What Is the Difference Between Disaster Recovery and Backup?

These two concepts are frequently confused with each other.

#### Backup

It creates a copy of the data.

The purpose is to bring back lost or corrupted data.

#### Disaster Recovery

It enables the technological service to be run again in another environment.

The purpose is for the whole system to keep serving.

Put simply:

**Backup = brings the data back.**

**DR = brings the service back.**

### Why Is DR Needed If There Is a Backup?

For example, suppose the organization has a critical ERP environment of 20 TB.

The backup may be in intact condition.

But if the main data centre is completely down, where will you restore this backup to?

New servers are needed.

Storage is needed.

Network is needed.

A firewall is needed.

DNS is needed.

Active Directory is needed.

Licenses are needed.

An internet connection is needed.

Backup provides only the data.

DR, meanwhile, keeps ready the alternative infrastructure on which that data will run.

### Which Scenarios Is Disaster Recovery Designed Against?

DR is not prepared for natural disasters alone.

In a modern DR strategy many scenarios must be assessed.

For example:

- Complete loss of the data centre
- A long-lasting power outage
- Fire
- Earthquake
- Flood or water damage
- Storage failure
- Core network failure
- Long-term loss of the internet connection
- Loss of the hypervisor infrastructure
- Ransomware
- Active Directory compromise
- Critical database corruption
- Cloud region outage

The recovery method can differ in each scenario.

### What Is a DR Site?

A DR Site is an alternative location prepared to be brought into service should the main systems become unusable.

This location;

a second data centre,

an office in another city,

a cloud infrastructure,

a hosting provider

or a DRaaS platform

can be any of these.

The main location is generally called:

#### Primary Site

in DR terminology.

The alternative recovery location, meanwhile, is expressed as:

#### DR Site

or:

#### Secondary Site

in the same terminology.

### What Is the Primary Site?

The Primary Site is the main data centre or IT environment from which the organization serves during normal operation.

For example:

ERP,

databases,

mail,

Active Directory,

file servers

run here.

In a disaster the goal is to move these systems to the DR location or to run them from there.

### Can the DR Location Be in the Same Building?

Technically it can be, but it carries serious risk from a real disaster recovery perspective.

For example, if the main system is:

- on floor 1

and the DR system is:

- on floor 2

then a fire, an electrical fault or a building-related event can affect both environments.

For this reason the DR location is preferably inside a separate failure domain.

### What Is Geographic Separation?

Geographic Separation is the creation of geographical distance between the Primary Site and the DR Site.

The purpose is to reduce the chance of the same disaster affecting both locations at once.

For example;

two different buildings,

two different districts,

two different cities,

two different regions

can be used.

However, as the distance grows, latency and replication problems can emerge.

For this reason the right distance must be determined according to business and technical requirements.

### What Is a Hot Site?

A Hot Site is a DR environment with a high level of readiness that can be brought into service quickly during a disaster.

In this environment;

servers,

storage,

network,

applications,

replicated data

may be in a ready state.

Some systems may be running continuously.

During the disaster only a failover operation may be required.

### Hot Site Advantages

The greatest advantage of a Hot Site is the low RTO.

Critical systems can be brought into service in a short time.

It can be preferred particularly in;

finance,

e-commerce,

manufacturing,

critical infrastructure

environments such as these with low interruption tolerance.

### Hot Site Disadvantages

The most important disadvantage is cost.

Because at the second location too;

servers,

storage,

network,

licenses,

operations

are required.

In some cases a second infrastructure is kept at close to production capacity.

For this reason a Hot Site can be high in cost.

### What Is a Warm Site?

A Warm Site offers a mid-level readiness between a Hot Site and a Cold Site.

In this environment the basic infrastructure exists, but all systems may not run continuously at production level.

For example;

server capacity is ready,

the network is ready,

backup or replica data is present,

but some applications need to be restored or started.

For this reason the RTO is longer than with a Hot Site.

### When Is a Warm Site Preferred?

It can be an economical option on systems whose interruption tolerance is a few hours.

For example, if the organization has:

RTO = 6 hours

as its target, a Warm Site may be sufficient.

### What Is a Cold Site?

A Cold Site is an alternative location with minimum readiness.

For example;

physical space,

power,

a network connection

may be ready.

However, the servers and systems may need to be installed.

For this reason it has the longest RTO.

### What Is the Advantage of a Cold Site?

The main advantage is cost.

A continuously running second infrastructure is not required.

However, the recovery time during a disaster can be long.

### Hot, Warm and Cold Site Comparison

| Feature | Hot Site | Warm Site | Cold Site |
| --- | --- | --- | --- |
| Readiness level | Very high | Medium | Low |
| RTO | Very low | Medium | High |
| Cost | High | Medium | Low |
| Data freshness | Can be very high | Medium | Depends on the backup |
| Failover speed | Fast | Medium | Slow |

The right choice must be made according to business need.

### What Is Active-Active DR?

In an Active-Active architecture two or more locations can serve actively at the same time.

For example:

the Istanbul DC

and

the Ankara DC

may be taking user traffic at the same time.

When one location is lost, the other location can keep the service running.

This method can provide an extremely low RTO.

### Active-Active Advantages

- Very short interruption time
- Load balancing capability
- Active use of the capacity
- Automatic failover capability

However, its design is quite complex.

### Active-Active Disadvantages

The most important problems are:

data consistency,

latency,

database replication,

session management,

network design

these subjects.

Not every application is suited to an Active-Active architecture.

### What Is Active-Passive DR?

In an Active-Passive structure the main system runs at the Primary Site.

Under normal conditions the DR Site is in a passive or standby state.

When a disaster occurs, the DR environment is made active.

This operation is called:

#### Failover

in DR terminology.

### Why Is Active-Passive Widely Used?

It can be simpler and more economical than an Active-Active architecture.

Especially in many enterprise infrastructures the:

Production → DR

replication model is used.

### What Is Failover?

Failover is the transfer of the service to an alternative system or location when the main system becomes unusable.

For example:

The primary database went down.

The secondary database was made active.

This operation is a failover.

Failover;

manual,

semi-automatic,

automatic

can be any of these.

### What Is Automatic Failover?

In Automatic Failover the system detects the interruption and brings the second system into service without human intervention.

This is used particularly on high availability systems.

However, if automatic failover is designed wrongly it can create serious problems such as split-brain.

### What Is Manual Failover?

In Manual Failover the authorized team makes the decision and initiates the transition.

This method can be slower, but it can provide an advantage particularly in events such as ransomware.

Because during an attack it may be undesirable for compromised data to be carried automatically into the DR environment.

### What Is Failback?

After the disaster has ended and the Primary Site has become usable again, bringing the systems back to the main environment is called:

#### Failback

in DR terminology.

Many organizations prepare a failover plan but do not plan the failback process.

This is a serious mistake.

### Why Is Failback Difficult?

While the system runs at the DR location, new data is created.

When the Primary Site is opened again, this new data has to be synchronized back.

A wrong failback can cause data loss.

For this reason the failback procedure absolutely must be tested in advance.

### Is Replication the Foundation of DR?

In most modern DR architectures, yes.

The data is transferred from the Primary Site to the DR Site by replication.

This;

storage replication,

database replication,

VM replication,

application replication

can take any of these forms.

### How Is Synchronous Replication Used in DR?

In synchronous replication the data is written to two locations at the same time.

For this reason a very low RPO can be achieved.

However, network latency becomes critical.

If the locations are very far apart, application performance can be affected.

### How Is Asynchronous Replication Used in DR?

In asynchronous replication the data is first written to the Primary Site.

It is then sent to the DR Site.

For this reason a small RPO arises.

However, it is more practical between distant geographical locations.

### Does DR Replication Replace Backup?

No.

This is one of the most important principles.

Replication:

**copies the current state.**

Backup:

**provides restore points from the past.**

For example, if ransomware encrypts the production files, the encrypted files can be replicated into the DR environment as well.

In that case both locations can be affected.

For this reason:

#### DR + Backup

must be used together.

### Should the DR Environment Be Backed Up Too?

Yes.

The DR environment must have its own separate security and backup strategy.

Because the DR location is a system in its own right and can experience data loss.

Moreover, a cyber attack can affect both locations.

### The Difference Between DR and Air Gap

DR provides availability.

Air gap provides isolation.

The DR environment may be continuously connected.

An air-gapped backup, by contrast, is deliberately separated.

For this reason, in strong architectures:

**Production + DR + Immutable/Air-Gapped Backup**

can be used together.

### A Sample Three-Layer Architecture

The following structure can be used in an organization:

#### Layer 1 – Production

The main systems run.

#### Layer 2 – DR Site

Critical systems are kept there by replication.

#### Layer 3 – Cyber Recovery Vault

Immutable and air-gapped backups are stored.

This structure provides different recovery options against different disaster types.

### How Safe Is DR in a Ransomware Attack?

This depends entirely on the design.

If DR is continuously managed through the same credentials, network and domain as production, the attacker can reach the second location too.

For this reason DR must have its own cyber security architecture.

### Should the DR Site Be in the Same Active Directory Domain?

It may be necessary from an operational perspective.

However, it can create risk from a cyber recovery perspective.

If the domain is completely compromised, the DR environment can be affected as well.

For this reason critical institutions in particular can evaluate separate identity layers or break-glass mechanisms for recovery.

### Should There Be Immutable Backup in the DR Environment?

Yes, it can be evaluated.

Replication can carry data corrupted by mistake or by an attack into DR.

Immutable backup provides the ability to return to a clean restore point in the past.

### What Is DRaaS?

DRaaS means:

#### Disaster Recovery as a Service

in full.

Instead of building a second physical data centre itself, the organization can use a service provider's cloud or data centre infrastructure.

Production systems are replicated into this environment.

In a disaster the systems are run on the provider's infrastructure.

### What Are the Advantages of DRaaS?

- The second data centre investment can be reduced.
- Faster deployment can be achieved.
- Capacity can be increased as needed.
- Geographic redundancy can be provided.
- Automation can be used.

### What Are the Disadvantages of DRaaS?

- Provider dependency
- Dependency on the network connection
- Egress costs
- Licensing
- Data location
- KVKK and regulation
- Provider outage

factors such as these must be assessed.

### What Is Cloud DR?

Cloud DR is the creation of the disaster recovery environment on a public or private cloud.

In normal times minimum resources can be run.

When a disaster occurs, resources are scaled up and the systems are brought up.

This approach can reduce cost.

### What Is Pilot Light DR?

It is one of the models used in the cloud world.

In the Pilot Light approach, critical core services are kept running continuously.

Other resources are created during the disaster.

This model can be thought of as between a Hot Site and a Warm Site.

### What Is Warm Standby?

In the Warm Standby model there is a smaller-capacity running copy of the production system.

During the disaster the capacity is increased.

This way a low RTO can be achieved.

### The Backup and Restore DR Model

One of the most economical DR methods in cloud environments is the Backup and Restore approach.

Backups of the systems are kept inside another region or account.

During the disaster the infrastructure is recreated and the backup is restored.

The cost is low.

However, the RTO is long.

### What Is Multi-Site Active-Active?

It is one of the highest resilience models.

Two or more sites serve at full or near-full capacity at the same time.

A traffic manager or global load balancer distributes users across the locations.

When one site is lost, traffic is directed to the other.

This method can provide a very low RTO.

However, it is one of the most expensive and complex models.

### Why Is DNS Critical in DR?

An application may come up successfully in the DR environment.

But if the user is still being directed to the Primary Site IP address, the service is unusable.

For this reason, in the DR plan:

DNS failover,

TTL,

load balancer,

global traffic management

must be planned.

### Why Is DNS TTL Important?

If the TTL value of the DNS record is very high, users can keep using the old IP address for a long time after the failover.

For example, if the TTL is:

24 hours

then the DNS change can propagate late.

On critical systems the right TTL strategy is important.

### How Is a Load Balancer Used in DR?

A load balancer can direct traffic by checking the health status of the systems.

If the Primary Site is unreachable, traffic can be sent to the DR Site.

This method can provide automatic failover.

### Does Application DR Work Without a Network DR Plan?

Most often no.

DR is not merely replicating VMs.

In addition;

the IP plan,

routing,

firewall,

NAT,

VPN,

MPLS,

SD-WAN,

DNS

must be planned.

### How Are Firewall Rules Carried into DR?

Firewall configuration backups must be kept.

However, storing the config file alone is not sufficient.

The DR network topology may be different.

For this reason a separate and tested firewall policy set may be needed for DR.

### How Is Site-to-Site VPN Used in DR?

User offices or other locations must be able to reach the DR Site.

For this, backup VPN or SD-WAN paths can be created.

When the Primary Site is lost, routing is directed to DR automatically or manually.

### Internet Service Provider Redundancy

The DR Site using a different ISP can reduce the single point of failure.

Using the same infrastructure of the same operator can reduce the advantage of geographic redundancy.

For this reason carrier diversity can be evaluated.

### Why Is Active Directory Critical in the DR Plan?

AD;

authentication,

DNS,

GPO,

service accounts

can be the core service for these.

Having a Domain Controller at the DR Site can reduce the recovery time.

However, care must be taken in ransomware and domain compromise scenarios.

### What Is AD Forest Recovery?

Should Active Directory become completely compromised or corrupt, the entire forest may need to be recreated from a trusted backup.

This is called:

#### Forest Recovery

in AD terminology.

It is far more complex than a normal DR failover.

For this reason it requires a separate procedure and exercise.

### How Is Database DR Done?

On database systems;

synchronous replication,

asynchronous replication,

log shipping,

Always On,

a standby database,

database-native replication

methods such as these can be used.

The right method is chosen according to the database RPO/RTO targets.

### Why Is Application Dependency Mapping Important?

The ERP server may have been brought up in DR.

But if the database is not running, the ERP does not work.

The database may be running, but without AD the user cannot log in.

For this reason systems must be assessed according to the recovery order.

### How Is the DR Recovery Order Determined?

A sample recovery order:

- Network infrastructure
- Firewall and core security systems
- DNS and Active Directory
- Storage
- Database
- Critical applications
- Web services
- File servers
- User systems

However, the real order must be determined according to the organization's dependency mapping and BIA work.

### How Does Business Impact Analysis Determine DR?

BIA shows which business processes are critical.

This way it is determined which system will be taken to DR first.

For example;

the payment system = Tier 1

ERP = Tier 1

the file archive = Tier 3

may be the classification.

The DR investment is made accordingly.

### Is DR Necessary for All Systems?

No.

On some low-priority systems a backup may be sufficient.

On critical systems, Hot DR may be needed.

For this reason cost and risk must be assessed together.

### Should DR Capacity Be the Same as Production?

Not always.

Some organizations keep the DR environment at lower capacity.

During the disaster only critical workloads are run.

This can be thought of as:

#### Degraded Mode

or limited capacity operation.

### What Is Minimum Viable Business in DR?

Not all services may need to run during a disaster.

The aim is for the organization to be able to sustain its critical activities.

For example, if there are normally 100 applications, only 20 critical applications may be run in the first stage of the disaster.

This approach can reduce the DR cost.

### The Human Factor in the DR Plan

DR is not technology alone.

At the moment of the disaster:

Who will decide?

Who will initiate the failover?

Who will inform customers?

Who will perform the network operations?

Who will validate the application?

These roles must be determined in advance.

### What Is Disaster Declaration?

When the DR plan will be activated must be clear.

You do not switch to DR on every 10-minute interruption.

Specific criteria can be established.

For example:

if it is anticipated that the Primary Site cannot come back within 2 hours

#### Disaster Declaration

is made and the DR process is started.

### Who Should Hold the DR Decision Authority?

A DR failover is a serious operation.

For this reason the decision authority must be determined in advance.

For example;

the CIO,

the IT Director,

the Business Continuity Manager,

the Crisis Committee

roles such as these can hold the authority.

### What Is a DR Runbook?

A Runbook is the procedure listing the technical steps to be applied at the moment of the disaster.

For example:

- Verify the incident
- Isolate the Primary Site
- Check DR replication
- Database failover
- Start the VMs
- Change DNS
- Test the application
- User access

The runbook must be as clear and as up to date as possible.

### Is a DR Document as a PDF Alone Sufficient?

No.

If the document sits untested for years, it may not be of use in a real disaster.

The DR plan must be a living process.

### What Is a DR Exercise?

A Disaster Recovery Test or DR Drill is the organization testing its disaster recovery plan in a real or simulated environment.

In this test an actual failover can be performed.

### DR Test Types

Testing can be applied at different levels.

#### Tabletop Test

The teams discuss the scenario at the table.

#### Component Test

A specific system is restored.

#### Partial Failover

Some services are taken to DR.

#### Full DR Test

The Primary Site is assumed unusable and critical systems are run from DR.

### Why Is a Full DR Test Important?

On paper all systems may be thought to be ready.

In a real test;

a DNS problem,

a missing firewall rule,

an expired certificate,

a missing license,

a broken replica,

a wrong credential

problems such as these can emerge.

For this reason DR capacity cannot be known in the real sense without testing.

### Should RTO Be Measured in the DR Exercise?

Absolutely.

For example, if the target is:

RTO = 2 hours

but in the test the system:

comes up in 5 hours 40 minutes

then the current architecture does not meet the target.

### Should RPO Be Measured in the DR Exercise?

Yes.

After the failover the timestamp of the last data must be checked.

This way the real data loss is measured.

### Should Business Units Take Part in the DR Test?

Yes.

The IT team can open the application.

But the business unit must verify that the application really works correctly.

For example, logging into the ERP is not sufficient.

Can an order be created?

Can an invoice be issued?

Can a report be produced?

These must be tested.

### What Is Cyber Disaster Recovery?

While traditional DR focuses on physical disasters, Cyber DR covers cyber attack scenarios in particular.

For example:

ransomware,

Active Directory compromise,

credential theft,

supply chain attack

recovery after these.

In Cyber DR what matters is not merely opening the service quickly, but opening it safely and cleanly.

### How Is a Ransomware DR Exercise Different?

In a normal DR test the Primary Site is assumed to be broken.

In a ransomware test, however:

**the Primary Site must be assumed to be under enemy control.**

In that case the production credentials may not be trustworthy.

The DR connections may be risky.

Replication must be stopped.

A clean restore point must be determined.

This is a far harder scenario.

### Why Is a Clean Room Important in Cyber DR?

After ransomware, systems can first be verified in an isolated Clean Room environment.

A malware scan is performed.

IOCs are checked.

Credentials are changed.

The DR environment is then opened.

### How Are DR and a Cyber Recovery Vault Used Together?

A sample structure:

Production → fast replication → DR Site

Production → immutable copy → Cyber Recovery Vault

If the main data centre is lost physically, DR is used.

If ransomware has affected both active environments, a clean restore is performed from the Cyber Recovery Vault.

This architecture is far stronger.

### The Cloud Region Failure Scenario

Using the cloud does not reduce disaster risk to zero.

A serious outage can occur in a region.

For this reason critical applications;

multi-AZ,

multi-region,

cross-region backup

can use designs such as these.

### Are an Availability Zone and a Region the Same Thing?

No.

An Availability Zone is a separate infrastructure area inside the same region.

A region, meanwhile, is a broader geographical cloud location.

Against a region failure, multi-AZ alone may not be sufficient.

### When Is Multi-Region DR Needed?

It can be evaluated for very low RTO targets or at high criticality levels.

However, network latency and cost increase.

### Data Sovereignty and KVKK in DR

If the DR Site or the cloud backup is located in another country, legal and regulatory requirements around data transfer must be assessed.

Data location matters particularly on systems containing personal data.

### Disaster Recovery from an ISO 22301 Perspective

ISO 22301 is the business continuity management system standard.

DR is one of the important parts of technical business continuity.

However, ISO 22301 does not focus on IT alone.

It also;

personnel,

facilities,

suppliers,

communication,

crisis management

covers business continuity subjects such as these.

### Disaster Recovery from an ISO 27001 Perspective

In ISO/IEC 27001 information security management, disaster recovery capability matters from the perspective of availability and ICT continuity.

Critical systems;

being backed up,

recovery processes being documented,

being tested

must be addressed on a risk basis.

### Are a DR Plan and a Business Continuity Plan the Same Thing?

No.

A DR Plan:

**brings the technology back.**

A Business Continuity Plan:

**keeps the business going.**

For example, if the ERP is down the BCP:

a manual order procedure

can define one.

DR, meanwhile, ensures the ERP is run again.

### The Difference Between Incident Response and DR

Incident Response, for the attack;

detects it,

analyses it,

isolates it,

eradicates it.

DR, meanwhile, ensures the service runs again.

In a ransomware incident the two teams must work together.

### Where Does Crisis Management Sit in DR?

Major interruptions are not merely technical events.

Senior management,

customer communication,

the regulator,

legal,

PR

these processes can come into play as well.

For this reason DR can be part of a broader Crisis Management structure.

### The Most Common Mistakes in DR Design

Mistakes frequently seen in organizations:

- mistaking DR and backup for the same thing,
- keeping the second location in the same failure domain,
- seeing replication as backup,
- choosing a product without setting RPO/RTO,
- not doing dependency mapping,
- not planning network DR,
- forgetting DNS failover,
- not planning Active Directory recovery,
- planning only failover and forgetting failback,
- not running DR tests for years,
- not including the ransomware scenario in the DR plan.

### Critical Questions to Ask in DR Design

Organizations must be able to answer these questions:

If the Primary Site is lost entirely, where do we move to?

Is the DR capacity sufficient?

How current is the data in DR?

What is the RPO?

What is the RTO?

By whom will the failover be initiated?

How will DNS change?

How will users reach the system?

What happens if AD is not running?

If ransomware corrupts the replica data, which backup will be used?

How will the failback be done?

If there are no answers to these questions, the DR architecture is incomplete.

### Conclusion: Disaster Recovery Is a Business Continuity Capability Beyond Backup

Backup is one of the fundamental parts of a disaster recovery strategy.

However, on its own it is not Disaster Recovery.

Real DR;

**alternative infrastructure,**

**replication,**

**network,**

**DNS,**

**identity services,**

**applications,**

**backup,**

**failover,**

**failback**

and **testing**

brings these processes together.

According to the organization's need;

**Hot Site,**

**Warm Site,**

**Cold Site,**

**Active-Active,**

**Active-Passive,**

#### Cloud DR

or **DRaaS**

models can be used.

However, what determines the right model is not the technology.

What determines it is:

**the RPO, the RTO, the business impact and the risk tolerance.**

Modern organizations must also separate classic disasters from cyber disasters.

After an earthquake, failing over to the DR Site may be sufficient.

But in a ransomware incident the DR Site itself may also be compromised.

For this reason a strong cyber resilience architecture most often uses these three layers together:

#### Production

↓

#### Disaster Recovery

↓

#### Immutable / Air-Gapped Cyber Recovery

This way the organization does not merely back up the system.

It also:

**determines in advance where, within what time and from which trusted data it will run again should the system be lost entirely.**

This is the real purpose of Disaster Recovery.