[gpfsug-discuss] Ransom attacks

[Jonathan Buzzard]

On 28/05/2021 07:46, Henrik Morsing wrote:
>>
>> That might not make sense if GPFS is holding the SP backup data, but 
>> SP can do its own replication too - and could replicate using storage from a
>> second GPFS file system off-site.  Take snapshots of this second storage,
>> as well as SP database, and again manage with a second sysadmin team.
>>
> 
> Thanks all for some useful replies, something to take forward.
> 
> In this case, SP is using GPFS for storing backup data, this solution 
> was meant to replace the tape libraries completely.
> 

If your backup is for disaster recovery that's fine. If you expand your 
disaster to include ransom attacks then disk based backups are IMHO 
inadequate simply because they can be gone forever in the blink of an eye.

> We protect the storage pools cross-site, but our solutions are 
> identical, so if you hacked one, you have hacked both.
> 

Currently we use a home grown disk based system for the backup (home 
grown because it's cheap) however we are looking to augment it with tape 
because tape is firstly ransom attack resistant, second tape is "green" 
with a very low carbon footprint.

 From a TSM perspective backup goes to the disk run as a bunch of 
sequential access files like "tapes", and the copy pool will exists on 
tape. We get the benefit of having the backup on disk aka the short 
access times to files, with the protection offered by tape should we get 
hit by a ransom attack.

JAB.

-- 
Jonathan A. Buzzard                         Tel: +44141-5483420
HPC System Administrator, ARCHIE-WeSt.
University of Strathclyde, John Anderson Building, Glasgow. G4 0NG