Tony Pearson IBM Master Inventor, Senior IT Architect, and Event Content Manager

(Guest Post: This is a guest post written by Tony Sater, IBM.)

Cyber resiliency is an organization’s ability to continue delivering the intended outcomes despite adverse cyber incidents. Cyber resiliency, Business Continuity and Disaster Recover share a common goal of protecting your data. Where cyber resiliency stands out is the confidence that the copy of revenue producing data, that would be used to restore a business from a cyber incident, has not been modified since it was ingested and can be reliably used to reduce the impact of a business outage due to a compromising attack.

Organizations are beginning to understand that traditional device-centric and technology-centric security measures, such as firewalls, fail to provide security in a Hybrid Multicloud cyber ecosystem. Moving forward, one must take a holistic approach across their data, applications, and the entire infrastructure to defend against and recover from a cyber-attack.

In order to more effectively deal with cyber events, the National Institution of Standards and Technology (NIST) provides a policy framework of computer security guidance for how organizations can assess and improve their ability to prevent, detect, and respond to cyber-attacks. This framework is an industry accepted methodology for building a plan to develop and implement safeguards to ensure delivery of critical business services.

Storage has for a long time played the role of “data custodian” in enterprise operations. In addition to providing containers where data goes when not in main memory, the system storage layer has traditionally provided protection solutions to recover from unusual events such as natural disasters, deliberate cyber-attacks, or accidental data loss or corruption. Over time, the range and sophistication of storage-based cyber resilience solutions has grown:

• Backup. Since the 1960s, storage has allowed application users to save a version of data on separate media to protect from accidental deletion, corruption, or primary device failure.
   
• High availability. Starting in the 1990s, storage began providing ways to keep data and systems available after failures, such as multi-path access, multi-server access, and duplication of data copies.
   
• Disaster Recovery. From the late 1990’s on, storage has provided designs to create replicated copies of active data at distances sufficient to protect from power outage or regional disasters like earthquakes, floods, or fire.
   
• Fast recovery on-line data recovery. And within the past 10 years, storage began providing snapshot copies of data for rapid recovery from accidental deletion or data corruption. IBM Storage provides all these traditional cyber resilience capabilities, but new data security threats are constantly surfacing. For example, Logical Data Corruption (LDC) through cyber-attack from ransomware and other rapidly evolving technologies presents a new set of protection considerations. To provide the needed level of protection, IBM Storage cyber resilience solutions leverage the storage tools already in place for backup and disaster recovery, plus many new storage innovations that improve on traditional technologies and address new threats.

Let’s take a look at some of the IBM Storage for Cyber Resiliency capabilities and solutions.

IBM DS8880 Safeguarded Copy prevents sensitive point in time copies of data from being modified or deleted due to user errors, malicious destruction or ransomware attacks. Here’s how it works. Safeguarded Copy provides functionality to create up to 500 recovery points for a production volume. These recovery points are called Safeguarded Backups. The Safeguarded Backups are immutable, hidden and non-addressable by a host. The data within these backups can only be used after a Safeguarded Backup is recovered to a separate recovery volume providing a "logical air gap" functionality. Finally, these recovery volumes can be accessed using a recovery system and used to restore production data, providing a rapid and operational recovery capability.

IBM Tape Storage offers a cost effective, long term backup and archive WORM storage, with a true physical air gap and total separation from ransomware and cyber-attacks. Tape is used to optimize data protection costs and mitigates the risk of ransomware for data-centric organizations. At a cost of less than a half a cent per GB (Gigabyte), it is also an extremely cost-effective solution.

IBM Spectrum Protect and IBM Spectrum Protect Plus can store backup data in all storage pools such as disk, tape, object and more. IBM Spectrum Protect Operations Center using backup data analysis can alert admins for any suspicious activity. Our Spectrum Protect portfolio delivers pervasive, end to end encryption capabilities. Customers utilize Spectrum Protect Node replication to replicate the spectrum protect data to the isolated location such as WORM Tape media. Furthermore, these backup copies can be sent to a physically secure off-site location. IBM Spectrum CDM also supports snapshots as well, which is the traditional backup and recovery method that delivers the lowest RTO (Recovery Time Objective).

IBM delivers four key capabilities of cyber resiliency that delivers across block, file, object, tape, software-defined storage, and cloud.

• Isolation is the degree of separation of snapshot or backup data from the rest of the network. Isolation can be achieved though logical means by utilizing DS8000 Safeguarded Copies or IBM Cloud Object Storage (COS) with IBM Resiliency Orchestrator. Isolation can also be achieved through a physical air gap with IBM Physical Tape and Spectrum Protect.
   
• Immutability, or tamper-proof storage, prevents any attacker, external or internal, from changing or deleting data. IBM offers multiple WORM (Write Once, Read Many) storage solutions such as DS8000 Safeguarded Copies, WORM Tape, Spectrum Scale Immutable file sets, IBM COS retention vaults, and Spectrum Protect for data retention.
   
• Performance is an important capability of the cyber resilience framework. How fast can your organization recover from a cyber-attack? While tape excels at isolation and immutability of your backup data, it can take several hours for recovery. For those companies that need to recover in minutes instead of hours, IBM offers high performing recovery options with DS8000 Safeguarded Copy and the Spectrum Protect family.
   
• Ease of reuse or the ease of access to your backup data is important for testing recovery procedures, validating backups, and restoring data into a sandbox environment to find a valid recovery point in the event of a ransomware incident. DS8000 Safeguarded Copy and Spectrum Protect Plus provide instant restore capabilities to get your organization back on its feet.

The pain points that organizations face are evolving as cyber-attacks increase. There is a need for a more precise, immediate response to cyber events. This response, to be effective, needs to be planned, prepared and tested well before experiencing a live attack, where the stress and pressure of the attack overwhelms the organization as it tries to recover. Data storage systems and technologies lie at the heart of efforts to build IT environments that are resilient to logical data corruption in all its forms. IBM Storage offers a broad spectrum of market-leading cyber resilience solutions that help 21st century business survive and thrive.

For more information about IBM’s Storage for Cyber Resiliency, please read [Mainframe Storage for IBM Z].

Christopher Vollmar IBM Storage Architect supporting customers in Canada and the Caribbean

Well, it's Tuesday again, and you know what that means? IBM Announcements!

These last few weeks saw some pretty significant action, the [IBM z15], and with that the [IBM DS8900F] as well. The DS8900F is the next in DS8000 family with even more features to support performance and security. It is built off the IBM POWER9 processor technology, the same processors that run in [Summit and Sierra], the two most powerful supercomputers in the world.

The new [DS8900F] series introduces two new classes for clients to leverage, the Flexibility class leveraging the DS8910F, and the Agility class with the DS8950F. These two classes provide a variety of configuration options and introduce new capabilities in the physical design and the functions available.

• DS8910F Rack Mounted - provides clients the option to leverage their existing racks for this storage solution. With its different configuration options it can take up as little as 15U of contiguous rack space, or as much as 20U of contiguous rack space. As a bonus, just like the DS8882F model, this model also has the ability to be racked in an IBM LinuxONE or IBM Z system.
   
• DS8910F Racked Solution - provides clients with the same capacity for POWER9 cores and power options, however it comes as an IBM rack integrated storage subsystem. It also provides for up to 2.5PB of Flash Storage as well as up to 64 host ports.
   
• DS8950F - is also a racked solution, but provides for even more scalability with the optional expansion frame.

Here is a quick comparison table:

One option that has been added to the new DS8900 platform is the 32Gb FC Host Adapter. It can support both FCP and FICON as you would expect, and it can auto-negotiate between 32Gb, 16Gb and 8Gb connectivity. At 32Gb and 16Gb speeds it also has the capability to perform Forward Error Correction (FEC). It can also enable Encryption of Data in Flight (EDiF) for FC Endpoint Security.

Flash card sizes range from as 800GB to 15.36TB capacities.

Now, lets talk about some of the capabilities, and security is a huge focus. Some of those highlights include;

Cyber Resilience with Safeguarded Copy

Using Safeguarded Copy, the IBM DS8900F prevents data from being modified or deleted due to user errors, malicious destruction or ransomware attacks with immutable point in time copies of production data and dual management control for increased security.

This new technology provides immutable points of data recovery that are hidden and protected from being modified or deleted due to user errors, malicious destruction, or ransomware attacks.These immutable copies are a trusted and secure source of data that can be used for a forensic analysis, or a surgical or catastrophic recovery.

For increased security, Safeguarded Copy provides dual management control and can be integrated with different disaster recovery and high availability configurations

Transparent integration to Hybrid cloud for IBM Z

IBM DS8900F enables an Hybrid Multicloud architecture as a new storage tier for backup and archive operations on IBM Z environments with no impact to IO performance and without the need of additional servers or gateways.

Transparent Cloud Tiering (TCT) protects data with AES-256bit encryption and provides significant savings in mainframe CPU utilization when migrating large data sets. TCT integrates with IBM Cloud Object Storage and can also provide transparent connectivity to IBM Cloud, Amazon S3 and an IBM TS7700 configured as an object storage target.

Secure authentication across trusted systems

As I mentioned above, using the new 32Gb FC Host Adapters, unique IBM technology makes data only accessible by authorized systems. The authentication ensures data is accessed only by trusted IBM Z, LinuxONE and DS8900F Systems, and provides for Encryption for data in-flight within and across data centers without application changes and without consuming IBM Z CPU resources.

IBM Fibre Channel Endpoint Security provides the authentication and encryption capabilities required for Data Privacy Passports and there is no performance impact on IBM Z or DS8900F to implement. In essence, links are authenticated such that a rogue, unauthorized host cannot gain access to data on DS8900F and unauthorized storage devices cannot connect to IBM Z and receive data. This is supported for z/OS, z/VM, and Linux on Z.

Ultra-low application response times

the IBM DS8900F moves performance to the next level with storage latencies as low as 18 microseconds for IBM Z with zHyperLink technology, 90 microseconds for distributed environments and a 50% reduction in transaction time for Db2 workloads based on IBM testing.

Storage Media that's encryption capable

all the flash options on the DS8900 are encryption capable. Data is always encrypted on writes to Flash media and then decrypted on read, and the media does the encryption at full data rate so it will not impact response times.

Data in flight can be encrypted by using Pervasive Encryption or Fibre Channel Endpoint Security (as mentioned above). Key management can be handled by IBM Security Key Lifecycle Manager (SKLM) or other KMIP compliant key manager.

If you want to learn more about the IBM DS8900 and its integration with IBM Z15 and IBM POWER systems you can also watch this [announcement video].

If you read our blog post [Storage Insights for Spectrum Control], and are looking to leverage Storage Insights, then you'll be happy to hear that the DS8900 is supported.

If your looking for some in-person sessions on the new DS8900, consider attending one of the [IBM Systems Technical University] events.

Tony Pearson IBM Master Inventor, Senior IT Architect, and Event Content Manager

This month, I was in Johannesburg, South Africa for IBM Systems Technical University, or TechU for short. This event was held at the Hyatt Regency in Rosebank, walking distance from the [Gautrain station], allowing local attendees to commute easily to the event.

Here is my recap of Day 3.

IBM Spectrum Scale on the Cloud

Slides are available on IBM Expert Network on [Slideshare.net]

Many attendees recognize IBM Spectrum Scale as the on-premise universal file and object storage system that allows all operating systems to access data. Not only is it used in the top two fastest supercomputers, Summit and Sierra, but also over 200 other supercomputers in the top 500.

 

What you may not know is that you can also run IBM Spectrum Scale in the cloud. For now, this is only available on IBM Cloud and Amazon Web Services, but IBM is working with other Cloud Service Providers to make it available on those platforms as well.

IBM Spectrum Scale is ideally suited for use in the Cloud. The ability to dynamically non-disruptively add or remove storage nodes, NSD servers, or NSD clients, while applications are running provide the elasticity that many always-on, cloud-native applications require.

 

Deliver your message! Organizing your PowerPoint and presenting to audiences

Slides are available on IBM Expert Network on [Slideshare.net]

Since TechU here in Johannesburg had fewer attendees than our events in Europe or North America, it has fewer speakers, in fewer rooms, across fewer days. As a result, we had to combine several presentations into one to conserve time slots. For this session, I combined the two I give at bigger conferences:

• Stack the Deck! How to Build Powerful PowerPoint Presentations
• Stand and Deliver! Public speaking tips from an experienced professional

While TechU is known mostly for deep technical education, we also teach soft skills like effective communication and public speaking. Speaking with purpose is considered one of IBM's [Top five soft skills you need to succeed in business].

A recent LinkedIn study, [The skills companies need most], found 57% of IT leaders say soft skills are more important than hard skills.

(A few years ago at an IBM all-hands meeting in Tucson, our General Manager had asked for volunteers to attend an upcoming conference. He said, "We need people who are subject matter experts in our products and solutions to answer questions, ... people who have good social skills and can communicate effectively."

The first person to raise her hand asked him "How many volunteers for each of those two categories?" as if engineers and software developers with subject expertise can't also be effective public speakers!)

Rather than just have 50 percent of my slides be "Stack the Deck" and 50 percent "Stand and Deliver", I restructured the talk into three sections: how to prepare, how to practice and rehearse, and how to present. The room was packed, indicating that this was a subject many people wanted to learn more about!

 

Closing Session

The TechU team knew in advance that the new IBM z15 and DS8900 models would be announced on Thursday, September 12, so the question was whether to schedule this event Wednesday/Thursday/Friday to have the announcement land in the middle, or Tuesday/Wednesday/Thursday and have the announcement land on the last day.

We decided on the latter, and used the Closing session to celebrate the new announcements. The announcements were made in New York at 8:00am EDT, which corresponded to 2:00pm in the afternoon here in Johannesburg.

My colleague, Maurice McCullough, gathered all attendees to the Solution Center to give highlights of the announcements, and select names from a bowl to give out prizes.

It was great to come back to Johannesburg for this event. I have been coming here since 1993, and the city keeps improving and evolving over that time. I do not know if TechU will be in Johannesburg or Cape Town next year, but I hope to come back to South Africa either way!

IBM has several more TechU events planned for October and November at: Bogota (Columbia), Las Vegas, NV (USA), Sydney (Australia), Prague (Czech Republic), Pernambuco (Brazil), and Bali (Indonesia). Check out the [IBM Technical Events] landing page for details.

Tony Pearson IBM Master Inventor, Senior IT Architect, and Event Content Manager

This month, I was in Johannesburg, South Africa for IBM Systems Technical University, or TechU for short. This event was held at the Hyatt Regency in Rosebank, walking distance from the [Gautrain station], allowing local attendees to commute easily to the event.

Here is my recap of Day 2.

Strengthen your security posture! Getting started with IBM Z Pervasive Encryption

Slides are available on IBM Expert Network on [Slideshare.net]

Since TechU here in Johannesburg had fewer attendees than our events in Europe or North America, it has fewer speakers, in fewer rooms, across fewer days. As a result, we had to combine several presentations into one to conserve time slots. For this session, I combined these three:

• Protecting the keys to the kingdom, by Eysha Powers
• z/OS Data Set Encryption, by Cecilia Carranza Lewis
• z/OS Data Set Encryption Implementation Best Practices, by Barbara White McDonald

As the former chief architect of DFSMS, the component of z/OS that implements data set level encryption, I took on the challenge to select and merge these slides into a coherent story.

The work paid off! For an 8:00am morning session, the room was packed full of attendees! Thank you to Eysha, Cecilia and Barbara for their help with this!

 

IBM Storage for AI and Big Data

Slides are available on IBM Expert Network on [Slideshare.net]

This session covered the various storage solutions IBM offers in support of Analytics and Artificial Intelligence (AI), including:

• IBM Spectrum Scale, a universal file and object system that supports all stages, from ingest of data to inference processing
• IBM Elastic Storage Server (ESS)
• IBM Spectrum Archive and IBM Cloud Object Storage (COS) for low-cost archival of data
• IBM Spectrum Discover for classifying and tagging data

I also included details on IBM's solutions for autonomous driving, and IBM's partnership with NVIDIA.

 

Z4R: Intro to Storage and DFSMS for z/OS

Slides are available on IBM Expert Network on [Slideshare.net]

(Last year, we launched the "z/OS Fast Start for Rookies" track. However, we discovered in Atlanta and Berlin that having titles like "z/OS Fast Start for Rookies: Intro to Storage" were difficult for our Mobile App because only the front half of the title showed on the little screen on your smartphone, preventing you to tell which session was which. To solve this, we shrunk the moniker down to three letters, Z4R.)

My colleague, Maurice McCullough, who runs the Storage track for TechU, normally presents this topic, but I offered to give him a break and do this one myself.

Rather than just covering the basics of DASD and Virtual Tape, I added a section on policy-based automation and storage management with DFSMS.

 

Did you know that Johannesburg is the largest city in the world that is not situated on a river, lake or shoreline? Its location was determined by gold found in the 1800s. The elevation of 5,700 feet (1,700 meters) is comparable to the mile-high city of Denver, Colorado!

IBM has several more TechU events planned for October and November at: Bogota (Columbia), Las Vegas, NV (USA), Sydney (Australia), Prague (Czech Republic), Pernambuco (Brazil), and Bali (Indonesia). Check out the [IBM Technical Events] landing page for details.