Zero Security Theatre
Patterns and anti-patterns
Patterns are practices that help when tested. Anti-patterns are common, usually well-intentioned practices that create paperwork without improving the result.
Patterns
Publish the demonstrated result beside the target
Every recovery objective appears with the timed result of the last real restore and its date. Empty cells are the honest output for systems that have never been recovered.
Rehearse the out-of-hours call
Exercise every critical vendor escalation path on a schedule and record who answered and how long it took. An unexercised path is unknown, and unknown is red.
Anti-patterns
Reporting backup job success as recoverability
A finished job says the data was copied. Recoverability is demonstrated by a timed restore into a clean environment that the business accepts.