A “how-to” guide on using cloud services for security-rich data backup
IBM Global Technology Services Technical White Paper September 2012 A “how-to” guide on using cloud services for security-rich data backup By Karin Beaty and Chris Bode Executive summary Contents 1 Executive Summary 2 Technology Advances 4 Service Management Best Practices 5 Standards-based Processes and Policies 6 Managing Physical Security 7 Analyzing your risks with data protection analysis 7 Summary The tremendous growth of data has created unprecedented challenges for businesses today. Although data growth can help improve efficiencies and expand market reach, it can also expose a business to more risks, such as data theft, fraud and service interruptions. With data becoming increasingly dynamic, in addition to business resilience and security, risk management has emerged as a top priority for best standards and practices in many organizations. In the September 2012 IBM Global CIO Study, with input from over 400 IT and C Suite managers, 37 percent of respondents cited data loss and 61 percent cited data breach as causing reputational harm. “IT...is like the heart pumping blood to the whole body, so any failure could threaten the whole organization's survival.” —IT manager, French IT and technology company Successfully balancing opportunity and reputational risk requires a strategy that includes a solid business resiliency plan along with dependable backup and restore policies for systems and processes. This also helps address the need for better security of data and applications, using advanced technology and analytical capabilities. IBM Global Technology Services Technical White Paper September 2012 Institutions Examination Council (FFIEC) standards. This capability is delivered through IBM® Tivoli® Key Lifecycle Manager software (TKLM), which supports 256-bit Advanced Encryption Standard (AES) data encryption and allows users to implement and manage a revolving set of keys that can be scheduled to automatically change on a calendar basis. For offsite backups requiring the highest standards of protection, optional Federal Information Processing Standard (FIPS) Publication 140-2 Level 1 certified encryption services are available. This white paper discusses how you can: ●● ●● ●● ●● ●● ●● Use IBM’s integrated technologies to help protect servers both in physical and virtual environments and more effectively use advanced techniques to help reduce data redundancy Act as a “virtual extension” of your backup environment with trained specialists who employ leading practices designed to provide around-the-clock support for backup and restoration services Help restrict access to data by independent users through data segregation Help improve data management by using stronger policies and procedures based on standards and industry-leading best practices Offer physical security to an organization’s data center environment to help protect network and servers and allow restricted access to data Help deliver a more thorough and unbiased assessment of an organization’s information technology (IT) infrastructure and backup processes, along with related business processes and organizational risk through data protection analysis TKLM is an optional robust tape encryption feature available for data at rest through Tivoli Key Lifecycle Manager software. The TKLM software can provide security-rich tape drive encryption and a user-managed interface for configuring and administering keys and certificates, along with a relational database (IBM DB2®) to help maintain metadata on keys and certificates and information on devices. For some configurations, customers may prefer client-side encryption, which provides encryption in flight and allows the customer to generate a one-time encryption key per protected server. It is supported for most backup types. The data is encrypted using customer-controlled keys prior to crossing the demarcation between IBM and the customer. In addition, the white paper helps determine if the protection of physical and virtual servers is key to improving business continuity and resilience, and looks at more effective ways to gain visibility to the backup and restore operations. Also, it examines the capabilities that would help manage ever-expanding data, while helping detect if your data security and backup are vulnerable. Server protection IBM SmartCloud Managed Backup provides integration with VMware’s vStorage API for Data Protection (VADP) technology in order to allow backups of virtualized environments in a much more efficient manner than if they were treated as physical environments. Both the Storage Area Network (SAN)-based transport method and the Network Block Device (NBD)-based transport method are supported to allow the solution to be flexible enough to fit a wider variety of customer environments. IBM’s aggressive integration with VMWare can significantly reduce the amount of time and effort system administrators are required to spend in order to prepare systems for restore, while simultaneously providing greater flexibility to the customer. In traditional recovery scenarios, physical machines for restores must be identified and either have their operating systems reinstalled or recovered using a system-imaging or bare metal restore (BMR) product before the core applications can be recovered and brought online. These traditional procedures are tightly coupled to the exact hardware make and model of the original machine, which may not be available at the time of recovery. By integrating with VMware, the need to first recover Technology advances to help better secure your data backup Without proper security measures, data that is being transferred over a network, or is “in flight,” can be susceptible to unauthorized access or “eavesdropping.” IBM SmartCloud Managed Backup offerings utilize leading data encryption and deduplication technologies to help protect data both in flight and at rest. Encryption IBM SmartCloud Managed Backup can provide 128-bit clientside file-level data encryption and allows users to generate an encryption key of up to 63 characters in length to provide in-f light encryption. SmartCloud Managed Backup can also provide an optional enhanced encryption capability for data at rest on tape that is designed to comply with Federal Financial 2 IBM Global Technology Services Technical White Paper September 2012 12 KB in size—as well as the index information needed to tie them together are spread across as many disks as possible in the system and each is concatenated onto other random data chunks. Only the IBM SmartCloud Managed Backup administration system can determine the distribution algorithm and then tie the relevant chunks together to make the information readable. the operating system by either a reinstall or through system imaging or BMR product is reduced. Instead, the restore of the operating system, data and application can be accomplished in a single pass without requiring intervention from the systems administrator. As a result, this integration allows enhanced flexibility in how the systems are recovered. During the restore process, IBM has the capability to reconfigure many aspects of the virtual machine during the single-pass restore, such as converting to thin provisioning or changing the network configuration. The net result is that the data stored in the system (as well as the indices) is distributed across the system. In addition, the need for the backup server to “rehydrate” the data means that even an unauthorized user who has gained physical access to a disk under false pretenses would, worst case, see only concatenated “shreds” of unrelated data strung together. With data deduplicated prior to leaving the protected host, less bandwidth is needed, helping you to protect more data over existing bandwidth and for longer periods. Increased resiliency with software-based data deduplication Data deduplication, an advanced compression technique, helps prevent others from reading data at the remote vault location. Data deduplication can identify redundant data at the source and store only unique chunks of information across files, file systems and servers. These data chunks—on average less than Smar tCloud Managed Backup Common Service Architecture and Management Centralized Backup Infrastructure Multiple Locations Managed Private Cloud, Dedicated Hosted Cloud and/or Shared Cloud Servers Media Libraries Unified Backup Domain Wide area network (WAN) Primary backup infrastructure VPN Centralized Management Monitoring Backup devices 3 IBM Global Technology Services Technical White Paper September 2012 Service Management Best Practices The solution has client-side deduplication integrated into the service. It removes redundant data at the source and can lead to reduced central processing unit (CPU), memory and input/output (I/O) utilization rates. It applies to flat file data, database and applications that are supported by the service. In virtual environments, one can offload the deduplication functionality to an alternate backup client to reduce the impact of backup on the virtual client. In addition, the IBM SmartCloud Managed Backup service infrastructure includes the IBM System x® 3650 M3 server, which is well suited to manage this load due to the availability of multiple CPU sockets and high-performance x86-based CPUs. Service Management Support Structure IBM SmartCloud Managed Backup support consists of a large team of trained specialists, who are located around the world, including: ●● ●● ●● By using a software-based deduplication engine, IBM can provide a single integrated and highly flexible deduplication solution. IBM can choose the location of deduplication occurrence on a per-backup-event basis, allowing multiple datasets within a single client to receive individualized treatment. Because the implementation is software based, the backups taken using one deduplication method are restorable using either deduplication method. This can identify duplicate data across datasets, regardless of how they are handled. Additionally, the software-based engine allows IBM to tightly couple the application and deduplication metadata during replication, allowing replicated backups to become immediately available. This coupling represents a significant improvement over previous replication techniques that required the storage to be indexed or the metadata to be manually manipulated— raising concerns about the timeliness and reliability of replicated backup events. IBM can also use the integration afforded by a software-based approach to tune the deduplication engine based on the type of backup being performed to help provide the optimal balance of data reduction and throughout. ●● ●● Steady State Global Support Center—Operates around the clock and helps monitor all infrastructure and services at Tier 1 and Tier 2 levels Global Transition and Deployment—Focuses on transition and deployment support, as well as asset management support services at Tier 3 Infrastructure and Network Support Services—Helps integrate virtually all production infrastructure and services, configures and maintains all network devices and covers security-related software and configuration Services Management—Focuses on client care and governance, new service rollouts, documentation and training Project Management Office—Supports large contract and major upgrade implementations, as well as providing project management for service offering improvements The service is complimented by a robust reporting capability, offering our clients increased management views of performance, usage and billing integration. Monitoring Re so lut ion Governance process and meetings Communication Document of understanding 4 ity Reporting l ibi Client-side deduplication allows IBM to help significantly reduce network utilization by decreasing the need to repeatedly retransmit data, which can result in fewer load data protection places on the network. When used in concert with IBM’s file system journal integration, which allows the backup software to process only changed files, backup runtimes are also dramatically reduced without as much impact on the customer’s machines. Vis ex p er t ise Service execution IBM Global Technology Services Technical White Paper September 2012 Service Management Support Governance IBM believes that communication is key to organizing and using that power for your benefit. With effective communication, IBM can demonstrate value as an extension of your IT team helping to protect your data. Data from each host that IBM helps protect retains its association with the originating host throughout its lifecycle. No other host within any segment of a customer’s organization can access another host’s data unless that permission has been specifically granted on a per-host basis. By controlling access to backups taken on a per-host basis, IBM can help protect your data not only from outside threats but also from unauthorized internal access by members of the customer’s organization who may not have administrative access to the host in question. Finally, IBM has automated auditing tools available that can track the origination of all restore events in order to correlate them with a valid customer request. Better efficiencies in customer data segregation Establishing standards-based processes and policies IBM SmartCloud Managed Backup allows for user data separation on a shared platform. For example, using Tivoli Storage Manager Collocation allows for the segregation of data by tape and by user. With collocation enabled, the server keeps files belonging to a group of user nodes on a reduced number of sequential-access storage volumes assigned to those nodes only. Collocation not only allows the segregation of data by user but can also reduce the number of volume mounts required when common users restore, retrieve or recall a large number of files from the storage pool. Collocation thus can also decrease the amount of time required for these operations. Each registered user server is placed into a specific “collocation group” that tells IBM SmartCloud Managed Backup to direct the specific data for each group to their respective common set of tapes. Proper management of your data starts with establishing policies and procedures based on time-tested standards and industry-leading best practices, such as IT Infrastructure Library (ITIL). However, first and foremost, IBM’s policy is to manage your data per your requirements, which set the parameters for handling and protecting your data. As part of those requirements, IBM works to provide the right levels of access and authentication, whether to a network, server or physical data center. Striking the right combination of user-based privileges and conservative data access control helps perform backup and restore tasks with optimal efficiency and f lexibility without sacrificing data security. A key factor for success is open and frequent communication between the customer and IBM SmartCloud Managed Backup. This communication comes through regular governance meetings and reporting as well as notifications of service impacting activity (backup failures, maintenance events and outage notifications). Access and authentication IBM SmartCloud Managed Backup can provide three levels of authentication and access control. The first level is designed to authenticate user or administrator access to the system. Although most enterprise backup and restore systems operate around a model of authenticating only a machine and not the human user, the solution works on the concept that both hosts and users must be authenticated. Registration establishes an Deduplication devices store data in one aggregate volume in order to realize global commonality and are designed to make better use of available storage. Although most customer data will reside on the same aggregate disk, no customer can access another customer’s data because the data is stored based on a unique client name and server definition properties configured during the client installation process. When retrieving data, each client must authenticate using the backup server, validate its internet protocol (IP) as the correct source for that client, and then can only browse the data it wrote. 5 IBM Global Technology Services Technical White Paper September 2012 identity for each client with the server. Once the server identifies the client, it assigns a unique client ID, which is passed back to the client for activation. Client activation passes the client ID back to the client, where it is stored in an encrypted file on the file system, effectively completing the cycle. Whenever remote client operations are performed, this ID is used to validate the client with a challenge or response mechanism. In addition to client activation, each user is provided with a unique account and password that must be individually authenticated before he or she can restore data from the system. connectivity—and only those hosts subscribed to the VLAN can be granted access. Each host subscribing to the backup service is provided with a unique node-name. The unique node-name is used much like a login ID, requiring a unique user-generated password that the administrator creates during the initial setup. Using this node-name and password combination allows access to your data and helps verify that no other data is visible. Industry-standard IP tables filter all incoming packets, allowing only a narrow range of communication ports assigned to the service on the incoming stream from the client to the server. All unneeded services are disabled, with the exception of those required to run reporting, monitoring and backups. With IBM SmartCloud Managed Backup, support staff access is granted based on Lightweight Directory Access Protocol (LDAP) authentication. Each user must have a valid login on the backup server, a registered token, and a validated and registered LDAP password. IBM follows a strict ITCS104 security policy for each backup server. The IBM security scan runs once a day to validate compliancy and a compliancy script is run on the server daily to help provide adherence to the security policy. The solution also includes installed firewalls for remote VPN access and blocked in-bound Internet traffic. Your service is provisioned on separate VLANs, and access control lists (ACLs) are applied to each VLAN interface, protecting each customer. Software firewalls run on each backup server, and system-level intrusion detection monitors file changes. Physical Security Physical access to data Protecting your networks and servers Stringent security controls and mechanisms also help control access to physical data centers, and support personnel are trained, certified and routinely audited to help manage data compliance with these procedures. Access to IBM data centers follows International Data Corporation (IDC) best practices and grants individual access requests only to support personnel authorized to access each specific backup infrastructure. Access can be granted on an as-needed basis by support personnel for anyone else requiring access. IBM personnel in our data centers are bound by policies including ITCS104 for physical security requirements, as well as strictly enforced IBM Business Conduct Guidelines and other legal and corporate mandates. Blocking threats and unauthorized access to your network and servers from internal and external sources is a critical aspect of data protection. Managed backup cloud offerings incorporate extensive firewall implementations and security-rich solution designs combined with access control software technology. IBM SmartCloud Managed Backup includes a private internal management network that can provide IBM support staff with remote access to each backup infrastructure. The management network facilitates the automation of the site—monitoring for alerts, backup validation and data collection. This network is protected through a security-rich firewall and virtual private network (VPN) that permits only specific hosts to gain access and even then only after they enter the proper validation sequence. This same VPN is used to provide a security-rich replication service between sites. If the IBM SmartCloud Managed Backup infrastructure is hosted in the IBM cloud and housed in our world-class IBM Business Continuity and Resiliency Services (BCRS) data center, then certain physical conditions may apply. IBM SmartCloud Managed Backup infrastructures can consist of either a locked rack on the data center floor or a dedicated data center locked cage containing one or more racks. Installed biometrics can further restrict access to raised-floor areas or In addition to using the private management network described above, the solution also uses a private backup network that connects your server to the backup server using Virtual Local Area Networks (VLAN) connectivity. The private backup network is a dedicated, isolated Ethernet network with no external 6 IBM Global Technology Services Technical White Paper September 2012 requirements, including the National Nuclear Security Administration (NNSA) Policy Letter NAP-14.x and Department of Defense (DoD) 5220.22-M scrubbing. areas where client data might be present, and personnel do not have the necessary login to the vault, nor is administrative access to vault data permitted. IBM can also restrict access by: ●● ●● ●● ●● ●● ●● Analyzing your risks with data protection analysis Overwriting client recovery device operating systems between events to remove access to operating system image, existing logins, application layer and all middleware that could be used to view, transmit or interpret data Prescribing a dual-control approach of operating and observing when running scripts on your behalf Reinforcing adherence to cleanup checklist by using another tool to perform a low-level delete of the desk to change the geometry of the device Utilizing numbered containers, digital container photos and scanned barcodes for media handling and in accordance with the capabilities and policies of the local courier service provider Performing frequent unannounced audits and daily site readiness meetings to enforce adherence to processes Applying strict controls to what IT equipment may be brought in and taken out of any IBM facility As part of the IBM SmartCloud Managed Backup portfolio, the data protection analysis tool can provide a more objective review of your current backup and restore environment. IBM specialists can use a nonintrusive data- gathering process to analyze metadata from your backup environment and to help you identify potential risks of exposure and alert you to any infrastructure or backup problems. Exhaustive centralized reporting includes identified locations, devices, servers, clients and backup network. Also, our data protection analysis tool is highly transparent to—and accessible by—a simple laptop configured for this purpose. You can remove the laptop and uninstall the backup agents at virtually any time. Although you have visibility of the metadata that is being collected, your data will not be readable because there is no available authentication information. Moreover, the node will be deleted from the laptop after the completion of the analysis. (Note: If the IBM SmartCloud Managed Backup infrastructure is deployed on your premises instead of an IBM data center, then you are responsible for the physical security of the data.) Summary In addition, safeguards are in place after data reaches the end of the retention period. If a backup set is deleted—for example, overwriting the data during daily maintenance—or if test data has been generated during a recovery test in the provisional data center, we can erase the old data, and in many cases, deliver the log from the erased job. Business complexities have rendered organizations susceptible to risks from data loss and corruption, and mitigating these risks is an immediate priority. As an industry-leading provider of cloud-based resiliency services, IBM combines best-of-breed hardware, software and services to provide you with an expansive cloud solution. Our highly trained specialists make it possible for your IT personnel to focus on more important business priorities. IBM can demonstrate the use of advanced technology for an effective backup system, along with service management best practices, physical security measures and wide reporting and analytics capabilities for enhanced security review. We have extensive experience managing thousands of information protection clients with more than 1 million backups per month, which can increase your confidence in our ability to safeguard your information. When tapes have reached the end of their lifecycle, they are destroyed on-premise by a tape services provider. A certificate of destruction is furnished by the provider in order to better manage compliance for secure destruction. Depending on the customer’s preference, the destruction may be witnessed by both IBM SmartCloud Managed Backup personnel and customer personnel. Similarly, disk devices storing customer data are subjected to a data scrub in order to completely sanitize the disks prior to being removed from service. Several different disk scrub types are available based on the customer’s specific 7 For more information To learn more about the IBM SmartCloud Managed Backup, please contact your IBM marketing representative or IBM Business Partner, or visit the following website: ibm.com/services/continuity © Copyright IBM Corporation 2012 IBM Global Services New Orchard Road Armonk, NY 10589 Produced in the United States of America September 2012 IBM, the IBM logo, ibm.com, SmartCloud, Tivoli, and System x are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the web at “Copyright and trademark information” at ibm.com/legal/copytrade.shtml IT Infrastructure Library is a registered trademark of the Central Computer and Telecommunications Agency which is now part of the Office of Government Commerce. ITIL is a registered trademark, and a registered community trademark of The Minister for the Cabinet Office, and is registered in the U.S. Patent and Trademark Office Not all offerings are available in every country in which IBM operates. This document is current as of the initial date of publication and may be changed by IBM at any time. THE INFORMATION IN THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING WITHOUT ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ANY WARRANTY OR CONDITION OF NON-INFRINGEMENT. IBM products are warranted according to the terms and conditions of the agreements under which they are provided. The client is responsible for ensuring compliance with laws and regulations applicable to it. IBM does not provide legal advice or represent or warrant that its services or products will ensure that the client is in compliance with any law or regulation. Actual available storage capacity may be reported for both uncompressed and compressed data and will vary and may be less than stated. Please Recycle BUW03021-USEN-02
© Copyright 2024