Securing data with HPE StoreOnce Catalyst data immutability and Commvault

[StorageExperts]

Secure your data against ransomware and malicious attacks with HPE StoreOnce 4.3.5 enhanced security features and Commvault Backup and Recovery Software.

– By James Ganley, Data Protection Solutions Engineer, HPE

Securing data is one of the key tenets of data protection, but it’s not just about having a robust data protection strategy with multiple copies of data stored both onsite and offsite. It also must include copies of the data that are not accessible or are not able to be changed or deleted in any way whether these changes are malicious or accidental.

Because data protection is more critical than ever

As news of more ransomware attacks and malicious data breaches appear in the headlines and as the frequency and complexity of these attacks increase, IT organizations are not only impacted financially for unlocking their data, but also suffer from reputation damage. After all, who wants to put their trust in a company that has been the victim of a data breach?  

When it comes to data protection, there’s no silver bullet that makes data safe from malicious attacks when applied. Your organization still needs to follow the best practice of 3-2-1 (3 copies of data on 2 separate types of media, and 1 copy offsite). Anti-virus software must be up-to-date, firewalls must be in place, and employees with access to sensitive or business critical data must follow company data security policies.

HPE StoreOnce with its Catalyst protocol is inherently more secure than other backup solutions. Why? Because data is stored in a propriety format that is only readable by an HPE StoreOnce backup appliance. Adding data immutability adds even more levels of security to reduce the risk of ransomware attacks.

In the event of a malicious attack and with 3-2-1 rule being followed, organizations can recover quickly and easily by deploying HPE StoreOnce and Commvault software. Infected systems can be isolated and then deleted, the overall defenses can be reviewed and strengthened, and mission critical data can be easily restored to the new environment.  

How HPE StoreOnce and Commvault work together to keep data safe

Data must also be immune to deletion or change in any way. Immunity must also be easy to manage across the backup software and the storage devices that the data is being stored on. Otherwise, it either gets ignored or mismanaged, leading inevitably to vulnerabilities that can be exploited. Joint HPE and Commvault innovation has led to new security enhancements from integration of HPE StoreOnce 4.3.5 and Commvault 11.30.23 that enable a simple and straightforward way to achieve secure backups.  

Although HPE StoreOnce already offered immutable data backups and Commvault provided the WORM (Write Once Read Many) option to be applied to a backup policy, backup admins were confused about what was set where and for how long and had to ensure that records were kept up to date to manage the backup policy. Relying on records that are only as good as the last update jeopardizes data security or integrity.  

Commvault’s added support of ISV-controlled data immutability for HPE StoreOnce keeps data safe in the event of a malicious attack on your network, ensuring that data integrity can be maintained, and that retention periods can be managed in one place. To take advantage of this offering, simply upgrade HPE StoreOnce to 4.3.5 or above and upgrade Commvault software to 11.30.23. It is recommended (although not required) that Dual Authorization is enabled on HPE StoreOnce to further enhance the security of the device, as this removes the possibility that data can be deleted accidentally. 

Once both systems have been upgraded, set the “Maximum ISV (Independent Software Vendor) Controlled Data Immutability Retention” in the HPE StoreOnce Catalyst store, activate Commvault software’s WORM Storage lock setting in the Storage pool and set the retention period to the same as that set on the HPE StoreOnce. Because different backup types will require different retention periods, and it makes no benefit to have daily, weekly, or monthly backups all stored in the same place, different retention periods can be set for the different HPE Catalyst stores being used.

On Commvault, different retention periods are also set on the different storage pools associated with these stores and are then combined into one single backup policy, ensuring that it is simple and easy to manage all the different retention periods in one place. If you have been using HPE StoreOnce for some time, the last thing you want to have to do is start from scratch with new Catalyst stores and new storage policies. All these features can be added to existing Catalyst stores on the HPE StoreOnce and storage pools on Commvault.  

Committed to protecting your data

Through their partnership, HPE and Commvault deliver validated data protection solutions that enable data management and protection. Commvault’s native integration with the HPE storage portfolio reduces cost and complexity and allows you to focus on driving positive business outcomes.

To learn more about setting up and configuring HPE StoreOnce Catalyst ISV-Controlled Data Immutability with Commvault Backup and Recovery software, check out this technical paper: HPE Reference Configuration for data protection with HPE StoreOnce Catalyst and Commvault

---

Meet Storage Expert blogger James Ganley, Data Protection Solutions Engineer, HPE

With over 10 years of experience in data protection and HPE Storage, James has in-depth knowledge of HPE Storage products and integrations with market-leading backup software. Specifically, he’s worked with Commvault over the past five years to enhance the customer experience when using HPE Storage products with Commvault software.  

Storage Experts
Hewlett Packard Enterprise

twitter.com/HPE_Storage
linkedin.com/showcase/hpestorage/
hpe.com/storage