Redp 5722
Redp 5722
US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule
Contract with IBM Corp.
Contents
Notices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Trademarks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Terms and conditions for product documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Applicability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Commercial use . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Privacy policy considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
This IBM® Blueprint outlines how CMTG and IBM have partnered to provide cyber resilient
services to their clients. CMTG is one of Australia's leading private cloud providers based in
Perth, Western Australia.
Correspondingly, the need to defend, detect and rapidly recover from cyber-attacks has
become one of the most critical business requirements of the decade. This is the essence of
cyber resilience. Cyber security focuses on defense. Cyber resilience, however, focuses on
an overall data resilience strategy to detect, respond and rapidly recover in near real-time.
Essentially, it is about the ability to recover your ‘minimum viable business’ to a pre-attack
state within hours or minutes.
The fastest growing type of cyber-attack is ransomware. In its 2022 study1, Interpol identified
ransomware as the number two threat; this includes all types of crime, not just cybercrime,
which highlights the severity of the issue.
Increasing an organizations level of maturity, in terms of cyber resilience, requires not only
adopting modern data protection mechanisms but also requires an ability to integrate
business automation processes that reduce overhead, ensure consistency, and remove
errors from all phases of the cyber security and cyber resilience processes.
This paper outlines how CMTG and IBM have partnered to provide cyber resilient services to
their clients. CMTG is one of Australia’s leading private cloud providers based in Perth,
Western Australia.
The IBM FlashSystem platform has evolved and adapted to the changing requirements over
the last few decades: from hardware-driven data reduction and encryption, policy based
management of immutable (cyber secure) snapshots and data replication, disaster recovery
and high availability to new hybrid cloud capabilities. Connectivity is provided via Fibre
Channel or Ethernet and with SCSI and NVMe based protocols. But two key characteristics
have always been maintained:
1. ultra-low storage latency with the highest levels of sustainable performance
2. ultra-reliable system designs with in-built redundancy and fault-tolerance.
1
https://www.interpol.int/en/News-and-Events/News/2022/Financial-and-cybercrimes-top-global-police-co
ncerns-says-new-INTERPOL-report
2 Building an Automated, VMware Aware Safeguarded Copy Solution to Provide Data Resilience
Figure 1 shows the IBM Storage Virtualize feature highlights.
The IBM FlashSystem family currently consists of models designed to address the full range
of application workload and cost requirements. Every solution comes with the intelligence and
capabilities that can make deployment and management of hybrid cloud architectures easier
for any enterprise:
IBM FlashSystem 5000 solutions offer entry-level cost efficiency within the traditional two
rack unit family architecture.
IBM FlashSystem 5200 offers an efficient end-to-end NVMe or hybrid flash 1U option with all
the performance and functionality of larger arrays. The 5200 is the entry point allowing
customers to benefit from up to 12 IBM FlashCore modules.
IBM FlashSystem 9500 is engineered to tackle the most demanding business and research
environments with the capability to sustain millions of I/O per second workloads while
maintaining microsecond latencies. The 9500 can support up to 48 IBM FlashCore modules
per 4U system.
Safeguarded Copy offers the functionality to regularly and automatically create immutable
snapshots of volume groups. The snapshots can e scheduled either internally by the
3
FlashSystem or by external orchestration software, such as IBM Copy Data Management or
IBM Copy Services Manager. Additionally, the triggering of new SGC snapshots can be
controlled through an SSH or secure REST API interface. See Figure 2.
After they are created, the volume copies within an SGC volume group cannot be modified.
Not only are they immutable from a data access point of view but also from a logical
configuration point of view. That is, the SGC volumes cannot be mapped to, and therefore
their data contents cannot be changed by, host servers, and the logical SGC objects
themselves cannot be deleted by a bad actor.
SGC is implemented using a policy-based management scheme where the policy defines a
frequency at which copies will be created (think hours to tens of hours), and a retention period
for each copy (think days to weeks). After a policy is created, the same policy can be
“attached” to one or more volume groups. All production volumes contained within that
volume group, and any new volumes created in that volume group, are then protected based
on the details contained within that policy. See Figure 3 on page 5.
4 Building an Automated, VMware Aware Safeguarded Copy Solution to Provide Data Resilience
Figure 3 How does IBM Safeguarded Copy - Validating copied data
In the unlikely event that your traditional backup environment has not also been attacked, you
can invoke backup recovery processes. However, consider the time it can take to recover your
‘minimum viable business’ from backups. The time it takes to recover data for the entire
organization can be even greater.
Safeguarded Copy provides snapshots on the same media as your production data. These
can be used to immediately restore or recover data onto your production systems without the
need for that data to be streamed from your backup systems, or over network links. By
restoring your data from the same media, the time needed to recover the data can be reduced
to minutes or hours instead of days or weeks.
Business processes can be added to daily running tasks to validate the data contained within
a chosen SGC volume group snapshot to proactively determine that the security of the data
has not been compromised. In addition, IBM is working on new workflows and data corruption
techniques that could be run against these clones. For example, IBM Sentinel, and the new
IBM Defender framework can make use of these clones to build a Cyber Vault architecture
5
and provide solutions to not only recovery (SGC) but detection and validation phases of your
cyber resiliency solution.
Whether the goal is operational automation, data copy validation or data protection, a
common challenge is how to get access to copies of usable data.
Access, whether the data is on storage arrays or copies of systems such as virtual machines,
typically requires multiple steps. These steps include business processes and controls and
then actually snapshotting or replicating the data.
Usable data might seem like a simple requirement. However, data consistency is critical.
Each layer in a modern application stack can have a different ‘consistent point in time’.
Therefore, creating a storage snapshot requires integration of checkpoints to ensure the
required level of consistency. Consistency is critical to enable a simple and smooth recovery,
which is the primary goal of making the copies in the first place.
IBM Storage Copy Data Management, delivered as a virtual appliance, addresses these
problems. SCDM provides self-service automation and APIs to leverage existing IT
infrastructures data copy services, including storage array snapshots. SCDM provides
replication and clone engines and integrates into application and operating system
consistency and check-pointing capabilities. The orchestration and automation of multiple
tasks enables complex work-flows that include application, operating system, and storage
tasks to be more easily configured, tested, and executed using a template-based
point-and-click interface.
CMTG
Established in 1998 in Perth, Western Australia, CMTG2 is an IT infrastructure and
managed service provider with extensive technical expertise across a variety of disciplines.
CMTG takes a holistic approach to IT services, taking responsibility for all aspects of the
customer IT environment, from infrastructure servers, storage, backup, cyber and network
security to end user support. Technical staff are extensively trained and certified, with many
years of experience in key technologies resulting in levels of certification and accreditation
that deliver quality best practice solutions to protect their client’s data.
Specializing in high performance data storage and application hosting, CMTG offers private
cloud systems in their enterprise-grade Data Centre coupled with ongoing support to give
their customers consistent Peace of Mind.
Maintaining long standing relationships with key technology providers, such as IBM, CMTG is
regularly briefed on new developments and industry adoptions. This allows opportunities to
2 https://cmtg.com.au/
6 Building an Automated, VMware Aware Safeguarded Copy Solution to Provide Data Resilience
present consistent improvements to customer IT environments that increase availability,
security, performance and productivity.
For over a decade, CMTG has underpinned the business and their key core private cloud
offerings on IBM storage, software, and infrastructure, by using the exceptional enterprise
availability, security, and consistent performance features offered throughout their platform.
Peace of Mind is CMTG’s core tenet. It is the undercurrent for all offerings, to provide
performance and security for their managed customers environments.
CMTG identified a customer requirement to deliver exceptionally secure storage, with the
core initiative being to offer a service that would snapshot a customer’s data at regular
intervals. These snapshots would need to be stored securely, as immutable data, such that
nothing could alter, modify or delete the content in any way. This would mean that CMTG
could provide an offering that allowed the complete restoration of a clean, tested, and
assured customer environment in minutes instead of hours or days.
One key additional requirement of this solution was the need for operating system level
consistency, with the potential to include application consistency, such that when a snapshot
is taken by the storage system, checks and balances would need to be in place to ensure the
operating system or application was in a quiesced state.
That is, the point in time that the immutable storage snapshot is taken must be coordinated
with the operating system or application to ensure all data written up to that point in time is
safely stored on disk in a manner that the data set can be represented into production in a
known good state.
The complexity of the exercise is in the orchestration required to communicate with the host
OS and for core applications to halt or quiesce I/O on the host for just the moment required to
take the safeguarded copy, immutable snapshot. After the snapshot is taken, then the host
must return to full operation with no interruption of service.
By realizing these requirements, CMTG saw this as the key to the timely representation of
clean customer data, offering significant enhancements in service flexibility as well as
substantial customer comfort.
After a thorough consultation process with IBM Systems Storage, IBM Storage Copy Data
Manager (SCDM) was identified as the key missing piece, completely fulfilling CMTG’s core
7
requirement for their customers and offering the orchestration required to address the
complexity of the operation.
The solution included SCDM, coupled with an IBM FlashSystem 7300 that uses Flash Core
module technology, and Safeguarded Copy. By using this solution, CMTG can create
immutable snapshots for their customer’s entire private cloud hosted environment at regular
intervals with application-level consistency. See Figure 4.
Customer production environments are now protected by using SCDM via a regular
scheduled safeguarded copy in concert with the VMware application aware quiesced
process, providing an RTO of essentially zero.
In addition, Storage Copy Data Manager provides CMTG with levels of Disaster Recovery
automation and resilience orchestration not previously obtainable. Historically, CMTG used
IBM’s Global Mirror with Change Volumes3 (GMCV) asynchronous block level replication
functionality to replicate production storage to DR. This method provided ‘Crash Consistent”
replicated volumes with a Recovery Point Objective (RPO) of between 5 and 15 minutes.
The CMTG DR environment is now further safeguarded by using SCDM orchestration which
co-ordinates both the VMware quiesce process, and a combination of IBM GMCV and the
IBM FlashCopy® snapshot functionality within the IBM storage subsystem.
By leveraging SCDM, CMTG now has a mechanism to have a known, good, and application
aware VMware-quiesced snapshot library of every customer environment in DR updated on a
regular basis for additional resilience. This ensures that a known good point-in-time customer
image can be accessed and promoted to production in a timely manner if the DR GMCV copy
has a non-bootable VM.
3 https://www.ibm.com/docs/en/flashsystem-5x00/8.6.x?topic=functions-remote-copy-function
8 Building an Automated, VMware Aware Safeguarded Copy Solution to Provide Data Resilience
See Figure 5 through Figure 7 on page 10 for example screenshots of the solution.
Figure 5 IBM Copy Data Management Job Report: List of completed jobs and tasks
9
Figure 7 Safeguarded Copy Orchestrated run times
Solution outcomes
The combination of IBM’s FlashSystem Storage, Flash Core Module technology and
Safeguarded Copy immutability, coupled with IBM Storage Copy Data Manager, has
significantly complimented the quality of the services offered by CMTG. They now form a
foundation offering to their entire hosted private cloud customer base, further enhancing the
Peace of Mind principle at CMTG’s core.
CMTG now protects their hosted customer data from themselves, from end user operator
error, ransomware and hacking attempts by leveraging the IBM’s Safeguarded Copy secure
immutability function of their IBM FlashSystem storage. CMTG also has the additional
comfort of knowing that they can restore and re-present into production tested, known good,
clean customer environments that are updated multiple times per day or as required.
The result is that the overall Recovery Time Objective (RTO) is significantly reduced by
several orders of magnitude with customer immutable copies available and fully operational
within the hour by using customer snapshots that are themselves proven and tested. In
addition, this flexibility further offers the ability to manage the RPO. The RPO is the maximum
acceptable amount of data loss after an unplanned data-loss incident that is expressed as an
amount of time. Essentially, more frequent application aware snapshots equate to a smaller
RPO.
The solution also provides an additional benefit. The ability to isolate and lock any affected
data store makes it available for future investigation, and subsequent analysis as is outlined
by IBM in their Cyber Vault solution architecture brief4.
As described, IBM Storage Copy Data Manager has also further enhanced CMTG’s services
capability for their hosted customer environment from a disaster recovery perspective. SCDM
offers the capability to automate and orchestrate safeguarded copy snapshot management at
the operating system and application layer and also oversees inter-site storage replication.
SCDM allows the re-presentation of known good, tested, clean and complete customer data
4
https://www.ibm.com/downloads/cas/ODKXBLR9 https://www.youtube.com/watch?v=_Qn9iBG8ub4
10 Building an Automated, VMware Aware Safeguarded Copy Solution to Provide Data Resilience
sets to their disaster recovery data center, so the customer can be fully operational within the
hour.
This functionality fulfills the CMTG requirement to maintain an operating system consistent
copy of their hosted customer data set at the very least once a day at the CMTG DR site,
which is in addition to the continual asynchronous replication processes in place. DR and
inter-site storage layer replication has been historically attended to by using IBM Global Mirror
Change Volume technology (GMCV). However, the level of service that CMTG provides to
their customers has been enhanced by leveraging SCDM to orchestrate and enhance the
event.
Historically, CMTG replicated data to DR at 5 minute intervals and offered crash consistency
only, because there was no assurance of application or operating system consistency. With
the addition of SCDM, CMTG now orchestrates the safeguarded snapshot of the entire
hosted customer environment. By using SCDM, CMTG replicates data in a clean known good
state. The customer environment can be represented into production in DR quickly, cleanly
and efficiently in an extremely timely manner, which provides enormous flexibility and comfort
to both CMTG and their customers.
SCDM as an orchestration tool coordinates the automation of all these complex events.
SCDM manages the interaction with multiple storage subsystems and the capability within
each. SCDM also managers the triggering of events with third party vendor technology. This
technology offers significant function and value to CMTG and their customers that is more
than the sum of its parts. The technology also provides a single dashboard view of the data
services and their current state for ease of use.
Conclusions
In working with IBM, CMTG continues to provide enterprise class data hosting and resilience
that protects customer data from not only natural disasters but also the danger of cybercrime.
CMTG managing director and co-founder Carl Filpo said the partnership with IBM has
resulted in a unique solution that has become the cornerstone of their business offerings.
“At CMTG, we are not simply interested in ticking boxes; our focus is on delivering a
genuine and robust solution to combat cybercrime and prevent data loss. Our customers’
peace of mind is paramount, knowing that their valuable data entrusted to us is not only
well-protected, replicated, and backed up, but also fully recoverable within the hour in case
of any unfortunate incident.
We strive to ensure that all our clients can continue to operate seamlessly, free from worry
about events that may occur. The cutting-edge solution we’re providing in collaboration
with IBM, goes beyond anything currently available in the cloud space. The result of the
technology is that our customers will gain a significant advantage and comfort, and that’s
something we’re extremely excited to offer.”
11
Authors
This blueprint guide was produced by a team of specialists from around the world.
Neil Morris has been an integral part of CMTG in Western Australia since 2007. Initially
serving as a Senior Technical Specialist for many years, over the past decade he has
overseen CMTG's Hosted Cloud platform, responsible for the day-to-day management of the
company's Hosted Cloud, ensuring the platform's resilience and availability.
Well versed in IBM Storage Infrastructure and Software, which has underpinned CMTG's
hosted cloud since inception, he has co-architected the multiple layers of resilience,
availability, and backup that protect CMTG's customers and has been primarily responsible
for architecting CMTG's immutability orchestration innovation currently deployed.
Stephen Doney is the Client & Vendor relationship manager at CMTG in Western Australia,
focused on vendor/client engagement and customer satisfaction. He has enjoyed a working
relationship with CMTG for over a decade across diverse roles with technology vendors, IBM
included, recommending innovative operational technologies to enhance the multiple layers of
resilience within CMTG's cloud platform.
Barry Whyte is an IBM Master Inventor working in the IBM Systems Group. Based in
Auckland, New Zealand, Barry is an IBM Principal Storage Technical Specialist in the Asia
Pacific region. Barry primarily works with the IBM Storage Virtualize (IBM SAN Volume
Controller and IBM FlashSystem) family of virtual disk systems. Barry graduated from The
University of Glasgow in 1996 with a B.Sc (Hons) degree in Computing Science. Barry joined
the IBM SAN Volume Controller development team soon after its inception and held many
positions, including performance architect, during his 20 years in development. Barry has
over 25 years experience developing, designing, and selling IBM Storage,
12 Building an Automated, VMware Aware Safeguarded Copy Solution to Provide Data Resilience
Notices
This information was developed for products and services offered in the US. This material might be available
from IBM in other languages. However, you may be required to own a copy of the product or product version in
that language in order to access it.
IBM may not offer the products, services, or features discussed in this document in other countries. Consult
your local IBM representative for information on the products and services currently available in your area. Any
reference to an IBM product, program, or service is not intended to state or imply that only that IBM product,
program, or service may be used. Any functionally equivalent product, program, or service that does not
infringe any IBM intellectual property right may be used instead. However, it is the user’s responsibility to
evaluate and verify the operation of any non-IBM product, program, or service.
IBM may have patents or pending patent applications covering subject matter described in this document. The
furnishing of this document does not grant you any license to these patents. You can send license inquiries, in
writing, to:
IBM Director of Licensing, IBM Corporation, North Castle Drive, MD-NC119, Armonk, NY 10504-1785, US
This information could include technical inaccuracies or typographical errors. Changes are periodically made
to the information herein; these changes will be incorporated in new editions of the publication. IBM may make
improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time
without notice.
Any references in this information to non-IBM websites are provided for convenience only and do not in any
manner serve as an endorsement of those websites. The materials at those websites are not part of the
materials for this IBM product and use of those websites is at your own risk.
IBM may use or distribute any of the information you provide in any way it believes appropriate without
incurring any obligation to you.
The performance data and client examples cited are presented for illustrative purposes only. Actual
performance results may vary depending on specific configurations and operating conditions.
Information concerning non-IBM products was obtained from the suppliers of those products, their published
announcements or other publicly available sources. IBM has not tested those products and cannot confirm the
accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the
capabilities of non-IBM products should be addressed to the suppliers of those products.
Statements regarding IBM’s future direction or intent are subject to change or withdrawal without notice, and
represent goals and objectives only.
This information contains examples of data and reports used in daily business operations. To illustrate them
as completely as possible, the examples include the names of individuals, companies, brands, and products.
All of these names are fictitious and any similarity to actual people or business enterprises is entirely
coincidental.
COPYRIGHT LICENSE:
This information contains sample application programs in source language, which illustrate programming
techniques on various operating platforms. You may copy, modify, and distribute these sample programs in
any form without payment to IBM, for the purposes of developing, using, marketing or distributing application
programs conforming to the application programming interface for the operating platform for which the sample
programs are written. These examples have not been thoroughly tested under all conditions. IBM, therefore,
cannot guarantee or imply reliability, serviceability, or function of these programs. The sample programs are
provided “AS IS”, without warranty of any kind. IBM shall not be liable for any damages arising out of your use
of the sample programs.
The following terms are trademarks or registered trademarks of International Business Machines Corporation,
and might also be trademarks or registered trademarks in other countries.
DS8000® IBM FlashCore® Redbooks (logo) ®
FlashCopy® IBM FlashSystem®
IBM® IBM Z®
VMware, and the VMware logo are registered trademarks or trademarks of VMware, Inc. or its subsidiaries in
the United States and/or other jurisdictions.
Other company, product, or service names may be trademarks or service marks of others.
14 Building an Automated, VMware Aware Safeguarded Copy Solution to Provide Data Resilience
Terms and conditions for product documentation
Permissions for the use of these publications are granted subject to the following terms and conditions.
Applicability
These terms and conditions are in addition to any terms of use for the IBM website.
Commercial use
You may reproduce, distribute and display these publications solely within your enterprise provided that all
proprietary notices are preserved. You may not make derivative works of these publications, or reproduce,
distribute or display these publications or any portion thereof outside your enterprise, without the express
consent of IBM.
Rights
Except as expressly granted in this permission, no other permissions, licenses or rights are granted, either
express or implied, to the publications or any information, data, software or other intellectual property
contained therein.
IBM reserves the right to withdraw the permissions granted herein whenever, in its discretion, the use of
the publications is detrimental to its interest or, as determined by IBM, the above instructions are not being
properly followed.
You may not download, export or re-export this information except in full compliance with all applicable
laws and regulations, including all United States export laws and regulations.
This Software Offering does not use cookies or other technologies to collect personally identifiable
information.
If the configurations deployed for this Software Offering provide you as customer the ability to collect
personally identifiable information from end users via cookies and other technologies, you should seek your
own legal advice about any laws applicable to such data collection, including any requirements for notice and
consent.
For more information about the use of various technologies, including cookies, for these purposes, see IBM’s
Privacy Policy at http://www.ibm.com/privacy and IBM’s Online Privacy Statement at
http://www.ibm.com/privacy/details in the section entitled “Cookies, Web Beacons and Other Technologies,”
and the “IBM Software Products and Software-as-a-Service Privacy Statement” at
http://www.ibm.com/software/info/product-privacy.
Notices 15
16 Building an Automated, VMware Aware Safeguarded Copy Solution to Provide Data Resilience
Back cover
February 2024
US Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule
Contract with IBM Corp.
Please recycle
ISBN 0738461482
REDP-5722-00