PowerMax arrays have great security and data safety features. That does not prevent malware within a server from writing encrypted/garbled data on top of good data. Enhanced processes, procedures, and tools for malware recovery are critical to business operations. PowerMax snapshots can help with rapid recovery after such a malware attack, providing many point-in-time options for business restoration.
PowerMax security
PowerMax is the world's most secure storage platform, with a long list of features including:
- Role-Based Access Control (RBAC) with multi-factor authentication for array management
- LUN masking for host access restriction
- FIPS 140-2 validate Data at Rest Encryption (D@RE), with a separate key for each drive
- End-to-End Efficient Encryption (E2EEE), providing host-side encryption and array data reduction efficiency
- Thin device data leakage prevention
- Tamper-proof firmware/hardware
- Secure boot device
That security is great for ensuring that the data written to the array is safe from harm or unauthorized access. However, none of that can validate that the data coming from an authorized server has not been compromised by malware.
PowerMax alerting to changes in workload
PowerMax arrays can alert for signs of changes in data usage which could be the result of a malware attack. Rapid increases in the capacity used for snap change data can indicate an unusual level of data being written. Rapid decreases in data reducibility (or increases in used capacity) can indicate that the nature of the data being written has changed. Monitoring is available to alert for these types of changes at the array and storage group levels, helping the storage team verify that the changes in the workload patterns have been made intentionally by the application team. If they are because of an actual attack, this may be the first warning the team will get.
PowerMax snaps to the rescue
Snapshot functionality is a key feature included with every PowerMax array. Since there is no additional licensing, customers can easily take advantage of this valuable service to provide enhanced data resilience for their business. And PowerMax snaps scale - up to 1024 snaps can be active for every data device in the array, even with 64k devices in use (yes, support for 64m active snaps). Policy-driven snapshots can provide consistent, recoverable application images on a frequent basis (such as every 10 minutes). Secure snaps cannot be deleted before their planned expiration date, preventing accidental or malicious early termination. In the event of a malware attack, customers can examine multiple snapshots to determine which has the most up to date copy of the business data without the malware impact. Restoration of that version to production is almost instant, minimizing the pain of the attack.
Policies keep it simple
Snapshot policies ensure that the correct snaps with the correct options happen and the planned frequency for all of the intended devices. Short-term retention for secure snaps with very short intervals provide granular recovery options. Medium-term retention provides options to reach further back in time without keeping every change that has happened (for space conservation). Extended-term snaps for possible legal hold requests and such, reaching much farther back in time, can be pushed out to cloud storage. Secure snaps are best used for short retention periods, since they cannot be deleted and thus lock down capacity in the array until they expire. Customers define the policies they want to use, and then those policies are easy to consistently apply across storage groups, combining the policies to create the needed protection for each group.
Oracle application example
For example, one customer has a 300TB, business-critical Oracle database. They understand that Oracle has great tools for recovery from many data issues. However, some data issues come from damage to the data files from outside of Oracle operations. Malware writing over data files, for example. Or there may be a bad data import that for speed reasons was done using direct import (no logging), which will bypass most of the Oracle options to undo the load. Or there could be other operational, software, or hardware errors. In these situations, having snaps means not having to wait for recovery through restore of a backup.
Snap policies provide them with multiple layers of protection. Secure snaps every 10 minutes ensure the granularity to be able to recover with minimized data loss. Local snaps every 6 hours give a view going back 2 weeks to avoid the use of most backups (though they will most likely be used to mount to an alternate server to extract or validate part of the data, as full restores from copies more than 48 hours old are rare). And cloud weekly copies provide historical views that can be very useful for legal requests or other special inquiries. And they are all available almost instantly, even with their large database size.
Business impact
Having a storage-based option for malware detection and recovery adds significant value to business-critical applications. Being able detect a malware attack early in the process can minimize the impact of the event. Restoring rapidly puts you back in operation rapidly, minimizing the impact to customers. (And you can easily keep a copy of the impact of the malware on the system if you want to do forensic exploration later.) Recovery happens at the same speed no matter how large the data involved may be. Overall, PowerMax snaps minimize the risk of malware attacks to the business, and may help with the cost (or availability) of cyber insurance coverage as well.
Summary
PowerMax snap capability is a powerful tool that allows customers to protect their critical data assets from disruption. It can protect from malware and many other maladies. And it scales to protect even the largest customers. PowerMax snaps are part of the reason that customers continue to vote with their wallets for PowerMax as the best high-end storage solution year over year (as reported by IDC, Dell had almost 50% share of high-end storage for 2020).
