Immutable Data Protection for Any Application
Total Page:16
File Type:pdf, Size:1020Kb
IMMUTABLE DATA PROTECTION FOR ANY APPLICATION Mike van der Steen Principal Systems Engineer Dell Technologies [email protected] Knowledge Sharing Article © 2020 Dell Inc. or its subsidiaries. The Dell Technologies Proven Professional Certification program validates a wide range of skills and competencies across multiple technologies and products. From Associate, entry-level courses to Expert-level, experience-based exams, all professionals in or looking to begin a career in IT benefit from industry-leading training and certification paths from one of the world’s most trusted technology partners. Proven Professional certifications include: • Cloud • Converged/Hyperconverged Infrastructure • Data Protection • Data Science • Networking • Security • Servers • Storage • Enterprise Architect Courses are offered to meet different learning styles and schedules, including self-paced On Demand, remote-based Virtual Instructor-Led and in-person Classrooms. Whether you are an experienced IT professional or just getting started, Dell Technologies Proven Professional certifications are designed to clearly signal proficiency to colleagues and employers. Learn more at www.dell.com/certification 2020 Dell Technologies Proven Professional Knowledge Sharing 2 Table of Contents Introduction .................................................................................................................................................. 4 Protecting Data from Cyber-Attacks ............................................................................................................. 4 Available Solutions .................................................................................................................................... 5 Protecting Any Application Data Beyond the Current Solutions .............................................................. 5 Dell Technologies PowerProtect DD Series Appliance .................................................................................. 5 Logical Layout with MTrees ...................................................................................................................... 5 Immutability with Retention Lock ............................................................................................................. 6 Enforcing Retention Lock on Data ............................................................................................................ 7 Independent Copies with Fast Copy ......................................................................................................... 8 Solution Overview of Immutable Data Protection for Any Application ........................................................ 9 Creating Immutable Data Copies .............................................................................................................. 9 Recovery of Protected Data .................................................................................................................... 13 Scripting the Solution for Automatic Protection ........................................................................................ 16 Configure the Private/Public Key for Client-Side Scripting ..................................................................... 16 Sample Shell Script to Create and Remove Fast Copy Instances ............................................................ 17 Scheduling the Script to Run Automatically ........................................................................................... 19 Immutable Data Protection Example for Avamar ....................................................................................... 20 Solution Requirements ........................................................................................................................... 20 Protecting Avamar Backups .................................................................................................................... 22 Recovering Avamar and Protected Data ................................................................................................. 24 Summary ..................................................................................................................................................... 35 References .................................................................................................................................................. 35 Disclaimer: The views, processes or methodologies published in this article are those of the author. They do not necessarily reflect Dell Technologies’ views, processes or methodologies. Dell.com/certification 3 Introduction Most organizations have Data Protection as a top priority to ensure business continuity and this is even more relevant today with the prevalence of Cyber-attacks. While these Cyber-attacks traditionally originate from a source external to the organization, attacks from bad actors internal to the organization is unfortunately a real threat. Mitigation strategies to protect the organization’s data includes hardening of operating systems, applications and devices. Additionally, regular backups must be taken of the data to provide a level of protection, but these do not safeguard data when the threat attacks both the backup systems and the data itself. Dell Technologies PowerProtect DD Series appliances3 (formally known as Dell EMC Data Domain and will be referred to as Data Domain in this article) provide Retention Lock capability. This feature, when enabled and applied to data stored on the appliance, prevents that data from being deleted or modified in any way. This results in backup data being stored on the appliance in an immutable manner. This Knowledge Sharing article provides an overview of the fundamental Data Domain features leveraged to create immutable copies of backup data, the process of creating them, the recovery process and a sample script to automate the daily tasks of creating these immutable copies. An example is provided for creating immutable copies of backups taken with Dell Technologies Avamar and the recovery process. Avamar is used as an example as this backup application at the time of writing this article does not have the capability to natively integrate with Data Domain Retention Lock feature. While the primary focus of this article is based on backup applications, it can be extended to incorporate any application storing data on Data Domain, hence providing immutable data protection for any application. Protecting Data from Cyber-Attacks There are several strategies that can be implemented to protect the organizations data from Cyber-attacks or internal bad actors. Dell Technologies recognizes the need to safeguard data and discuss the Good, Better, and Best in a Layered Cyber Security for Data Protection approach as shown in Figure 1. Figure 1- Dell Technologies layered Cyber security for data protection1 2020 Dell Technologies Proven Professional Knowledge Sharing 4 The base layer or a good level of protection is achieved by performing regular backups of the organization’s data. The second layer or better level of data protection requires hardening of the backup application and appliances. In addition, leveraging retention lock capability to ensure data is stored in an immutable manner. Finally, the last layer or best level of data protection requires a cyber recovery solution where the organization’s most valuable data is stored in a separate or air-gapped environment. This solution focuses on providing a better level of data protection for those applications that do not integrate natively with Data Domain Retention Lock and enabling protected data to be stored in an immutable manner. Available Solutions Dell Technologies’ data protection portfolio includes a Cyber Recovery Solution2 where data is safeguarded in an isolated environment designed to protect the organization’s most critical applications. This type of data normally represents a small percentage of the overall data managed by the organization’s Information Technology (IT) department. Organizations that use NetWorker4 and/or PowerProtect Data Manager5 have native integration with Data Domain Retention Lock feature. This enables those organizations to achieve a better level of data protection. Protecting Any Application Data Beyond the Current Solutions There are numerous data protection applications in the market. Some applications, including Dell Technologies Avamar are unable to leverage Data Domain Retention Lock natively, which means that data protected by Avamar is not stored in an immutable state. To help organizations achieve a better level of data protection by storing protection data in an immutable state, a scripted based solution is provided in this article. While the primary focus of this solution was designed for organizations using Avamar, it can in fact be applied to any application writing data to a Data Domain appliance. Dell Technologies PowerProtect DD Series Appliance At the core of the solution described in this article and of any Dell Technologies Data Protection solution is the PowerProtect DD Series appliance, otherwise known as Data Domain. Data Domain is not exclusive to Dell Technologies Data Protection solutions and is used with many industry-leading data protection software applications. There are numerous key features which make it a perfect protection storage platform for organizations, including its variable length deduplication algorithm, global deduplication within each appliance and the Data Invulnerability Architecture to name