Section 24.2. Technical Reasons for Data Protection

24.2. Technical Reasons for Data Protection

As previously discussed, data protection is all about keeping company information safe (from accidental or intentional deletion, corruption, and mishandling), available (to authorized users as well as business departments and outside partners), and compliant (with various industry guidelines and governmental regulations), and that doing this is often quite challenging. From a technical standpoint, the job is equally challenging. Disk drive failures, worn tape cartridges, lost or stolen media, and the inherent security risks of network storage all complicate the IT task.

24.2.1. Device Issues

Many of the technical reasons for data protection stem from the characteristics of the many different devices that store data. Every new device increases the chances of failure or attack.

24.2.1.1. Disk failures

Physical disks (or disk volumes) can fail for a variety of reasons. While the average mean time between failure supplied by the vendor of an expensive disk drive is quite high, other factors such as usage, handling, and environmental conditions can affect the reliability of disk drives. Disk failures can also result from outside factors, such as fires, natural disasters, and acts of physical terrorism.

24.2.1.2. Tape media wear, stolen/misplaced tapes

Data is written to tape in a sequential fashion rather than in a random fashion like disk; consequently, both the tape drive and tape media can experience significant wear and tear during frequent read and write actions. Tape media is also highly susceptible to environmental factors such as humidity and heat.

Because data is typically written to tape in an unencrypted plain-text format (such as tar2), unauthorized users can rather easily retrieve information from the media. Therefore, stolen or misplaced tapes can result in a significant exposure to a company's intellectual property and the personal information of its customers. This is why it's important to have good physical security of your backup media.

24.2.1.3. Networked storage risks

Implementing storage networks, whether storage area networks (SANs) or network-attached storage (NAS) environments, is a two-edged sword in terms of pros and cons. On the one hand, storage networks can significantly improve data availability and manageability. On the other hand, they can open new security risks.

Prior to the advent of networked storage, ATA or SCSI disk drives were directly attached to host servers in a local area network (LAN) environment. (This is now referred to as direct-attached storage, or DAS.) With DAS, the only way to compromise the data on these drives was to compromise the security of each individual host. Because servers were "insulated" from widespread hacking, companies were able to set up different security levels in the LAN depending on the datatype.

In a networked storage environment, the situation is different. It is possible, depending on the configuration and the security level of a given storage network, to access multiple hosts' data from a compromised host without physically hacking into each host. If one host is compromised and is able to "see" the other hosts' disks, the hacker can gain access to the data on those hosts without physically compromising those servers, too. Access to communication between these servers is enabled over network protocols, such as Unix-based NFS, Windows-based Common Internet File System (CIFS), Fibre Channel, or IP-based iSCSI.

A hacker, if so motivated, could also attack hosts, as well as stage other attacks, from the vantage point of the storage. The hacker could do things within the storage environment that would wreak havoc in the computing environment, such as denying all hosts access to shared data. Suddenly all your data is unavailable, and you have no idea why.

Email Can Be Critical

I was the email administrator for a medical software company, and I warned our system administrators that we needed to back up certain email stores more often and to put the email stores on a RAID-protected disk. Both of them blew me off. About a month after I became the email admin, the CEO, CIO, CFO, and "owner" email stores were corrupted due to disk issues (the physical disk was failing). It took some real creative work on all of our parts to get the data back so we didn't lose the docs on a multimillion dollar deal. (We were a 50-person company, and this was a huge deal for us.) After that day, I put in a mirror drive and hosted the CXO's and owner's email stores. The backup admin started reading the daily reports on what successfully backed up and what didn't. (He had been getting a daily report that was being sent automatically to his trash.)

Scott Boss

24.2.2. External Threats

In addition to risks introduced by the types of devices that are in use, there are threats introduced by the people who use or have access to the devices. These include viruses, worms, Trojan horses, and, of course, accidental or intentional deletion.

24.2.2.1. Viruses

Microsoft's definition of a virus is a good place to start. It defines a virus as "a piece of computer code that attaches itself to a program or file so it can spread from computer to computer, infecting [software, hardware, and files] as it travels."

24.2.2.2. Worms

A worm, like a virus, is designed to copy itself from one computer to another, but, unlike viruses, it does so automatically by taking control of features on the computer that can transport files or information. Once you have a worm in your system, it travels alone; it does not have to attach itself to a program or file to wreak havoc with your system or others.

Worms are also dangerous because they can replicate in great volume through email address books. The result can be devastating, causing heavy network traffic that can bring business networks to their knees and slow down Internet traffic considerably.

24.2.2.3. Trojan horses

As for Trojan horses, just as the mythological Trojan horse tricked the city of Troy into believing it was receiving a gift, today's Trojan horses, which often come in the form of email attachments, trick users into believing they are receiving security updates or other important information. In reality, they are recipients of hidden viruses that attempt to disable antivirus and firewall software.

Whether the threat is a virus, worm, or Trojan horse, it is extremely important for companies to protect themselves against these types of attacks. Once they're in, they can be extremely difficult to purge from your environment.

24.2.2.4. Accidental deletion

Whether companies admit it or not, data loss caused by human error is a common occurrence. It takes the form of accidental deletion of a single file, an entire filesystem, or a user from a network configuration. The only way to recover from this type of internal threat is through a historical copy such as a backup or snapshot.

24.2.2.5. Intentional deletion

Some data is deleted because a malevolent person decides it should be deleted. There was a major incident a few years ago when a malicious employee deleted every file on every server and desktop at a major financial institutionall because he didn't get the raise he wanted. A good data protection system might notice that this has happened or even prevent it from happening. At a minimum, a good data protection system should be able to restore the data in question.