How Zerto users can get the most out of immutable backups
Zerto users can create and manage immutable data backups within the vendor's long-term retention capabilities. Immutability is key to ransomware protection.
Immutability is sometimes sold as the cure-all for many issues within IT, with dozens of different interpretations of what immutability means. What is immutability and how is it used? That will differ by company, but Zerto's long-term retention capability is one example of how a vendor offers immutability.
Zerto 9.5 offers long-term retention (LTR) with immutability, a recent addition to the vendor's array of disaster recovery and backup tools. In IT terms, immutability can be described as a form of write one, read many (WORM) storage.
A basic example of immutability that most administrators understand is snapshots. Once a snapshot is taken, it becomes read only under normal operations. No further writes can occur. All changes are committed to a newly created separate disk file, which enables the original disk to stay in pristine condition if the administrator needs to revert the VM to its original state. It's a cornerstone of VM management.
Immutability and VM challenges
With regards to immutability and VM backups, it becomes a bit more complex. As more companies move to cloud-based backups, their reliance on immutability grows.
As more companies move to cloud-based backups, their reliance on immutability grows.
Backups and restores can be slow and cumbersome. Customers that have Zerto use the product as a middling stop gap with swift restoration capabilities. This makes the integrity and restorability of long-term retention data key.
The VMware environment has some ransomware technologies that can encrypt hypervisor disk files. Carbon Spider and Sprite Spider are two ransomware developments that can use a now-patched vCenter flaw to gain access to hypervisor disks.
In a worst-case scenario, a ransomware tool could take out the working environment and encrypt the non-air gapped LTR files.
The issue is that while the product itself may mark something as immutable, that doesn't mean a compromised OS/hypervisor on which the OS is hosted could not delete, corrupt or encrypt those files. This would essentially pull the immutability capability from the product.
This is part of the reason immutability is offered first in AWS and S3-compatible storage systems. While the highly controlled nature of AWS storage and the files that make up the VM may be immutable under normal circumstances, malware could encrypt the underlying disk. That's before even considering data loss due to hardware failure.
Preserve backup integrity with object locks
The integrity of LTR backups is crucial -- once completed, any change means a point-in-time snapshot isn't a true point-in-time copy.
In Zerto 9.5, the platform provides the option to prevent changes to LTR backups for defined periods. Administrator can specify windows of immutability during which even standard administrator accounts can't manipulate data. This functionality is achieved with S3 object locks.
Object locks offer a form of special retention that prevents changes to the data in question. If a VM disk is object locked, it is considered immutable by almost all accounts.
If several dozen VMs become encrypted, it's possible to quickly and efficiently restore them from the LTR backup copy to just prior to the incident happening. Those LTR backups are essentially cast in stone and can be restored from AWS.
