Data protection is a critical concern for any organization. Data loss due to hardware failure, human error, or cyber-attacks can have catastrophic consequences. NetApp's new ASA storage systems have data protection features designed to secure data at rest and in transit and ensure recoverability during a disaster.
Securing Data at Rest
New ASA systems provide robust mechanisms to secure data at rest. This is crucial for preventing unauthorized access to data if storage mediums are repurposed, returned, misplaced, or stolen. Here’s how data at rest is protected:
- NetApp Storage Encryption (NSE): NSE employs hardware encryption with self-encrypting drives (SEDs) that encrypt data as it's written. Each SED has a unique encryption key, and nodes must be authenticated to access this key.
- Onboard Key Manager: New ASA provides an onboard key manager to serve authentication keys to nodes. Alternatively, an external key manager can be configured to serve the same purpose.
- Dual-Layer Protection: For additional security, software encryption can be enabled on top of NSE, adding another layer of protection.
Securing Data in Transit
For data in transit, especially using the NVMe/TCP protocol, new ASA systems can be configured to use Transport Layer Security (TLS) to encrypt data sent over the network from NVMe hosts to the new ASA system. This encryption ensures that sensitive information is not intercepted during transmission.
Protecting Against Ransomware Attacks
To safeguard against ransomware attacks, new ASA systems offer the ability to replicate snapshots to a remote cluster and lock them, making these snapshots tamper-proof. Even if the primary data is compromised, these locked snapshots can be used to recover the data.
Snapshot Replication for Disaster Recovery
New ASA allows for snapshot replication to a remote location, which is essential for disaster recovery and data migration. By establishing a replication relationship, consistency groups containing multiple storage units can be replicated to a remote cluster. This ensures that in the event of a system failure, data can be recovered from the remote site.
SnapMirror for Disaster Recovery
New ASA systems use SnapMirror to replicate data to a secondary location, providing a robust disaster recovery solution. This replication ensures that in the event of a primary system failure, data can be quickly recovered from the secondary site, minimizing downtime and data loss.
Snapshot Replication
SnapMirror works by replicating snapshots of storage units or consistency groups. These snapshots capture the state of the data at specific points in time and can be used to restore the system to a previous state if necessary. This is particularly useful for point-in-time recovery and backing up data without impacting the performance of the primary storage.
Creating Replication Relationships
To use SnapMirror, a replication relationship must be established between the source new ASA and the remote location. This relationship sets the foundation for the replication of consistency groups to the remote cluster, which can be used for disaster recovery or data migration.
Testing Failover with SnapMirror
An important feature of SnapMirror in new ASA is the ability to test the replication failover. This allows administrators to validate that data can be successfully served from the replicated storage units at the remote cluster if the source cluster goes offline. This testing ensures that failover plans are effective and can be trusted in an actual disaster scenario.
Tamper-Proof Snapshots
To protect against ransomware attacks and other malicious activities, SnapMirror can be used to create tamper-proof snapshots. These locked snapshots cannot be deleted accidentally or maliciously, providing a secure backup that can be used to recover data if the primary storage unit is compromised.
SnapMirror and SnapLock
For organizations that require immutable snapshots to comply with regulatory requirements, SnapMirror can be used in conjunction with SnapLock. This combination enables the creation of tamper-proof snapshots that are protected against ransomware attacks. By initializing the SnapLock compliance clock and creating a replication relationship, administrators can ensure the integrity and immutability of their data.
Restoring Data
If data is lost or corrupted, new ASA provides the ability to restore from snapshots. This can be done for a single storage unit or an entire consistency group, replacing the current data with the data from the snapshot.
Conclusion
NetApp's new ASA systems offer comprehensive data protection features to secure data at rest, protect it in transit, and ensure recoverability. With hardware-level encryption, secure key management, tamper-proof snapshots, and robust replication capabilities, new ASA systems provide the tools necessary to protect data from a variety of threats.
