A Technical View of Risk Assessment Methods for Backup Systems Bradley Wong Life Sciences Consulting Tustin, CA – USA DIA/All Hands: 12 February 2015

Introduction Risk Assessment Methodology Backup Strategies –Traditional Method –Virtual Tape Library / Virtual Tape Server –Deduplication and other new ideas 12 February 2015DIA Electronic Information Integrity CommunitySlide 2

Risk Assessment Methodologies Identify –The risks, their causal factor, and potential to harm Analyze –The probability of occurrence of each risk and its severity Mitigate –The creation of a risk mitigation plan Maintain / Monitor –The effectiveness, periodic review and update. 12 February 2015Slide 3DIA Electronic Information Integrity Community Identify Maintain / Monitor Mitigate Analyze

Risk Assessment Methodologies We will use the Risk Assessment Methodology to analyze the Backup Strategy 12 February 2015DIA Electronic Information Integrity CommunitySlide 4

Traditional Backup Methods More than 15 Years ago Backup device generally attached to the server or a backup server. Backup media generally magnetic tapes with optical for longer term storage. 12 February 2015DIA Electronic Information Integrity CommunitySlide 5

Traditional Backup Methods Media has a limited lifetime before its usefulness would be in question. Set a strategy for the type of media and perform a refresh of the media. Periodic Checking of tapes by performing restores and checking for errors. 12 February 2015DIA Electronic Information Integrity CommunitySlide 6 Identify Mitigate Monitoring

Traditional Backup Methods Media manufacturers have different specifications that affect the retention life of the product Use known sources and try not to deviate. Check with sources to see if the media sources change. 12 February 2015DIA Electronic Information Integrity CommunitySlide 7 Identify Mitigate Monitoring

Traditional Backup Methods Compatibility of old media with future retrievals Standards for Migration of data to the new media. Periodically extract files to verify readability. 12 February 2015DIA Electronic Information Integrity CommunitySlide 8 Identify Mitigate Monitoring

Traditional Backup Methods Compatibility of old media with future retrievals Standards for the obsolescence of old data. Periodically extract files to verify readability. 12 February 2015DIA Electronic Information Integrity CommunitySlide 9 Identify Mitigate Monitoring

Traditional Backup Methods Compatibility of old media with future retrievals Standards for the obsolescence of old data. No need for monitoring unless you track how often you delete files that you really need. Then you would update your standards. 12 February 2015DIA Electronic Information Integrity CommunitySlide 10 Identify Mitigate Monitoring

Traditional Backup Methods The number of tapes required for a restoration is generally larger. Standards for handling of tapes from the backups. Periodically extract files to verify catalog of tapes. 12 February 2015DIA Electronic Information Integrity CommunitySlide 11 Identify Mitigate Monitoring

Traditional Backup Methods Missing a tape in the middle of the set, it might render the set useless. Standards for handling of tapes from the backups. Periodically extract files to verify catalog of tapes. 12 February 2015DIA Electronic Information Integrity CommunitySlide 12 Identify Mitigate Monitoring

Traditional Backup Methods Active files during the Backup process. Define a mechanism to ensure that the save is performed accurately and at a “Point in time”. Perform periodic restoration activities. Possibly in conjunction with Disaster Recover testing. 12 February 2015DIA Electronic Information Integrity CommunitySlide 13 Identify Mitigate Monitoring

VTL/VTS 12 February 2015DIA Electronic Information Integrity CommunitySlide 14 Hard Disk Tape JukeboxOptical Jukebox

Virtual Tape Library Years ago Backup moves from device to a server Backup media combination of Hard Disk Drives and Magnetic Tapes Optical common for longer term storage. 12 February 2015DIA Electronic Information Integrity CommunitySlide 15

Virtual Tape Library Shared Risks as the Traditional Backup –Media has a limited lifetime before its usefulness would be in question. –Media manufacturers have different specifications that affect the retention life of the product. –Active files during the Backup process. 12 February 2015DIA Electronic Information Integrity CommunitySlide 16

Virtual Tape Library Compatibility of old media with future retrievals Standards for Migration of data to the new media. The feature is included in the VTL system. Periodically extract files to verify readability. 12 February 2015DIA Electronic Information Integrity CommunitySlide 17 Identify Mitigate Monitoring

Virtual Tape Library The number of tapes required for a restoration is generally larger. Tapes are catalogued by the VTL system. Periodically extract files to verify catalog of tapes. 12 February 2015DIA Electronic Information Integrity CommunitySlide 18 Identify Mitigate Monitoring

Virtual Tape Library Disk Failure in the pool. RAID configuration. Service Contracts for repair of failed media. Media failure in the hard disk pool. RAID configuration Proactive replacement of disks. 12 February 2015DIA Electronic Information Integrity CommunitySlide 19 Identify Mitigate Monitoring Identify Mitigate Monitoring

Virtual Tape Library Media failure in the tape pool. Watch systems for tape errors. Proactive replacement of tapes. Network communications. Private network for backup services. Service Contracts for repair of failed hardware 12 February 2015DIA Electronic Information Integrity CommunitySlide 20 Identify Mitigate Monitoring Identify Mitigate Monitoring

Virtual Tape Library System failure. Multiple backup systems. Maybe two small ones instead of one big one. Service Contracts for repair of failed media. Failure of a single tape could have a greater effect on the backup. 12 February 2015DIA Electronic Information Integrity CommunitySlide 21 Identify Mitigate Monitoring Identify

Virtual Tape Library Migration/File Location Metadata. Documented Qualification. Monitor error logs. 12 February 2015DIA Electronic Information Integrity CommunitySlide 22 Identify Mitigate Monitoring

Virtual Tape Library Handling of media errors when reading/writing data during saves or migrations. Documented Qualification. Monitor error logs. 12 February 2015DIA Electronic Information Integrity CommunitySlide 23 Identify Mitigate Monitoring

Deduplication 0-5 Years ago Backup moves from device to a server Backup media is mainly Hard Disk Drives Magnetic Tapes and Optical common for extracted longer term needs. 12 February 2015DIA Electronic Information Integrity CommunitySlide 24

Deduplication Shared Risks as the Virtual Tape Library and Traditional Backup –Media has a limited lifetime before its usefulness would be in question. –Media manufacturers have different specifications that affect the retention life of the product. –Active files during the Backup process. 12 February 2015DIA Electronic Information Integrity CommunitySlide 25

Deduplication Shared Risks as the Virtual Tape Library and Traditional Backup –Disk Failures in pool –Media failure in Hard Disk Pool 12 February 2015DIA Electronic Information Integrity CommunitySlide 26

Deduplication Flaws in compression algorithms or loss of algorithms can lead to the entire backup pool being lost. Documented Qualification. Monitor error logs. 12 February 2015DIA Electronic Information Integrity CommunitySlide 27 Identify Mitigate Monitoring

Deduplication Errors in Hash function causes different file chunks to point to same location. Calculate Risk. None. 12 February 2015DIA Electronic Information Integrity CommunitySlide 28 Identify Mitigate Monitoring

Outsourcing Separation of data. Private VPN. Audit. 12 February 2015DIA Electronic Information Integrity CommunitySlide 29 Identify Mitigate Monitoring

Summary Backup methodology has dramatically changed over the past 20 years. –A Current Risk Assessment of the Backup Strategy should be in place. –Old Risk Assessment of the Backup Strategy are still useful and make a good starting point for update. 12 February 2015DIA Electronic Information Integrity CommunitySlide 30

Thank You Bradley Wong (714) February 2015DIA Electronic Information Integrity CommunitySlide 31