{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/availability","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/availability/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/availability/"},"term":{"en":"Availability","da":"Tilgængelighed"},"aka":{"en":[],"da":[]},"domain":["security"],"cluster":"fundamentals","layer":"data","status":"current","summary":{"en":"Making sure information and systems can be used by the right people when they are needed.","da":"At sikre, at information og systemer kan bruges af de rette personer, når der er brug for dem."},"body":{"formal":{"en":"The property that information and systems can be reached and used on demand by those allowed to use them, within agreed times. It is lost through faults, overload, power cuts and attacks alike.","da":"Egenskaben, at information og systemer kan nås og bruges efter behov af dem, der har lov til det, inden for aftalte tidsrammer. Den kan gå tabt ved fejl, overbelastning, strømsvigt og angreb."},"plain":{"en":"Like a shop's opening hours - the goods are no use to anyone if the door is locked when customers arrive.","da":"Som en butiks åbningstider - varerne gavner ingen, hvis døren er låst, når kunderne kommer."},"inPractice":{"en":"A power cut takes down the patient record system at a Danish regional hospital; for three hours doctors and nurses work from paper lists and phone calls until it is running again.","da":"Et strømsvigt lægger patientjournalsystemet ned på et hospital i en af regionerne; i tre timer arbejder læger og sygeplejersker ud fra papirlister og telefonopkald, indtil systemet kører igen."},"whyItMatters":{"en":"Every hour a key system is down can stop sales, delay care or halt production - which is exactly what attacks like ransomware aim for.","da":"Hver time et vigtigt system er nede, kan salget stoppe, behandlinger blive forsinket eller produktionen gå i stå - og det er netop, hvad angreb som ransomware går efter."}},"deepDive":{"en":"ISO/IEC 27000 defines availability as the property of being accessible and usable on demand by an authorised entity. Operationally it is expressed as a ratio, A = MTBF / (MTBF + MTTR), where MTBF is mean time between failures and MTTR mean time to repair or restore. The \"nines\" convert directly into downtime budgets: 99.9 % allows about 8.8 hours of unavailability per year, 99.99 % about 53 minutes and 99.999 % about 5.3 minutes. Because MTTR sits in the denominator, faster detection and recovery often buy more availability than more reliable hardware.\n\nComponents combine predictably. In a serial chain where every part must work (DNS, load balancer, application, database), availabilities multiply, so four components at 99.9 % each give roughly 99.6 % overall. Redundant components in parallel fail only together, giving 1 − (1 − A1)(1 − A2), which is why N+1 designs, clusters and multiple availability zones are the standard tool. The caveat is common-mode failure: two replicas sharing a power feed, a configuration push, an expired certificate or a single identity provider fail at the same moment, and replication faithfully copies deleted or encrypted data to the standby.\n\nContinuity planning adds two targets per service. The recovery time objective (RTO) is how long the service may be down, and the recovery point objective (RPO) is how much data, measured in time, may be lost. Both come out of a business impact analysis, as in ISO 22301, and drive the choice between restoring from backup, warm standby and active-active operation. ISO/IEC 27002:2022 covers this ground in controls 5.30 (ICT readiness for business continuity), 8.13 (information backup) and 8.14 (redundancy of information processing facilities). Backups only support availability if restores are tested and at least one copy is offline or immutable, since ransomware targets backup catalogues first.\n\nAvailability differs from reliability (the probability of running without failure over a period) and from resilience (the ability to keep delivering a degraded service and recover). It is lost through hardware faults, capacity exhaustion, software bugs, failed changes, DoS attacks and ransomware alike, which is why IT operations, not only security, owns most of it. GDPR Art. 32(1)(b) and (c) require the ability to ensure the ongoing availability and resilience of processing systems and to restore access to personal data in a timely manner, so a prolonged loss of access can itself be a personal data breach. Availability often competes with confidentiality: aggressive account lockout, strict MFA or encryption with poorly escrowed keys can deny legitimate users access.","da":"ISO/IEC 27000 definerer tilgængelighed som egenskaben at være tilgængelig og brugbar efter behov for en autoriseret enhed. Driftsmæssigt udtrykkes den som et forhold, A = MTBF / (MTBF + MTTR), hvor MTBF er den gennemsnitlige tid mellem fejl og MTTR den gennemsnitlige tid til reparation eller genopretning. \"Nitallene\" kan omregnes direkte til et nedetidsbudget: 99,9 % tillader cirka 8,8 timers utilgængelighed om året, 99,99 % cirka 53 minutter og 99,999 % cirka 5,3 minutter. Fordi MTTR indgår i nævneren, giver hurtigere opdagelse og genopretning ofte mere tilgængelighed end mere pålideligt hardware.\n\nKomponenter kombineres forudsigeligt. I en seriel kæde, hvor hver del skal virke (DNS, load balancer, applikation, database), ganges tilgængelighederne, så fire komponenter på hver 99,9 % giver cirka 99,6 % samlet. Redundante komponenter i parallel fejler kun samtidig, hvilket giver 1 − (1 − A1)(1 − A2), og derfor er N+1-design, klynger og flere availability zones standardværktøjet. Forbeholdet er fælles fejlårsager: to replikaer, der deler strømforsyning, en konfigurationsudrulning, et udløbet certifikat eller en enkelt identitetsudbyder, fejler på samme tid, og replikering kopierer loyalt slettede eller krypterede data til standby-systemet.\n\nBeredskabsplanlægning tilføjer to mål pr. tjeneste. Recovery time objective (RTO) er, hvor længe tjenesten må være nede, og recovery point objective (RPO) er, hvor meget data, målt i tid, der må gå tabt. Begge udspringer af en konsekvensanalyse (business impact analysis) som i ISO 22301 og styrer valget mellem gendannelse fra backup, varm standby og active-active-drift. ISO/IEC 27002:2022 dækker området i kontrol 5.30 (IKT-parathed til forretningskontinuitet), 8.13 (backup af information) og 8.14 (redundans i informationsbehandlingsfaciliteter). Backup understøtter kun tilgængeligheden, hvis gendannelser testes, og mindst én kopi er offline eller immutable, fordi ransomware går efter backupkatalogerne først.\n\nTilgængelighed er ikke det samme som pålidelighed (sandsynligheden for at køre uden fejl i en periode) eller robusthed (evnen til at levere en nedgraderet tjeneste og komme sig). Den går tabt ved hardwarefejl, kapacitetsmangel, softwarefejl, fejlslagne ændringer, DoS-angreb og ransomware, og derfor ejes det meste af den af IT-driften og ikke kun af sikkerhedsfunktionen. Databeskyttelsesforordningens art. 32, stk. 1, litra b og c, kræver evnen til at sikre vedvarende tilgængelighed og robusthed og til rettidigt at genoprette adgangen til personoplysninger, så et langvarigt tab af adgang i sig selv kan være et brud på persondatasikkerheden. Tilgængelighed konkurrerer ofte med fortrolighed: aggressiv kontospærring, stram MFA eller kryptering med dårligt deponerede nøgler kan udelukke legitime brugere."},"edges":[{"type":"part-of","to":"security/cia-triad","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/confidentiality","why":{"en":"More locks protect confidentiality but can make information harder to reach; the two must be balanced.","da":"Flere låse beskytter fortroligheden, men kan gøre information sværere at nå; de to skal balanceres."},"confidence":"high","strength":"normal"},{"type":"used-with","to":"platform/monitoring","confidence":"high","strength":"normal"}],"depth":0,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"ISO/IEC 27000:2018 - Information security management systems - Overview and vocabulary","tier":"standard","publisher":"ISO/IEC"}],"draft":true}