What is high availability?
High availability (HA) is the practice of designing a system so that it keeps serving users when individual parts fail. Disks, servers, power supplies, network links and whole data centers will fail eventually; an HA design expects that and arranges for something else to take over quickly, usually automatically. The method is to find every single point of failure, meaning any component whose loss stops the service, and remove it with redundancy and failover. Availability is the A in the CIA triad, so HA is a security concern as well as an operations one.
Measuring availability in nines
HA targets are stated as the percentage of time a service is up:
| Target | Allowed downtime per year | Per 30-day month |
|---|---|---|
| 99% (two nines) | About 3.65 days | About 7.2 hours |
| 99.9% (three nines) | About 8.76 hours | About 43 minutes |
| 99.99% (four nines) | About 52.6 minutes | About 4.3 minutes |
| 99.999% (five nines) | About 5.26 minutes | About 26 seconds |
Each extra nine costs far more than the last. Expected availability can also be calculated from failure data as MTBF divided by the sum of MTBF and MTTR.
How components combine
Parts in a chain multiply. If every request must pass through a firewall and then a server, each 99.9 percent available, the chain is about 99.8 percent available, worse than either part. Redundant parts work the other way: two independent servers that can each carry the full load, with instant failover, are unavailable only when both are down at once, so the pair reaches about 99.9999 percent. Real figures are lower, because failures are rarely fully independent and failover takes time, but the arithmetic shows why HA adds redundancy at every layer.
Building blocks
- Load balancing spreads requests across several servers and stops sending traffic to any that fail health checks; it suits stateless web tiers.
- Clustering lets nodes share one service, such as a database, and move it to a healthy node, using quorum to prevent split-brain.
- Replication keeps a standby copy of data current, synchronously over short distances or asynchronously over long ones.
- Multiple availability zones or sites keep a building-level failure from stopping everything.
- Redundant power and networking: dual power supplies on separate feeds, UPS and generator, two internet providers, and paired switches and firewalls.
- Monitoring that detects failure and triggers failover without waiting for a person.
High availability vs. fault tolerance, disaster recovery and backups
Fault tolerance is the stricter goal of no interruption at all when a component fails, typically through fully duplicated hardware running in lockstep; HA accepts a brief failover pause. Disaster recovery restores service after an event that takes out a whole site, measured against recovery time and recovery point objectives. Backups protect against deletion and corruption. HA does not replace them: replication and clustering copy a ransomware encryption or a dropped table to every node just as faithfully as good data.
High availability on the CompTIA Security+ exam
High availability falls under SY0-801 objective 3.4, which covers resilience and recovery in security architecture, where it is taught with load balancing, clustering and other forms of redundancy. Wording such as "the service must keep running if a server fails", "minimize downtime", "eliminate single points of failure" or "five nines" points to HA. Distractors include backups, which recover data but don't keep a service up; RAID, which protects only against disk failure; a hot site, which addresses the loss of a whole location; and autoscaling, when the scenario is about failures rather than changing demand.