Ransomware Recovery for a Regional Imaging Archive
Riverside Imaging owns a 180 TB DICOM archive on an HPE Alletra 6000 array at its primary data center. Backups go to an HPE StoreOnce appliance over 10GbE, and snapshots replicate to a DR site 250 km away. The clinical SLA is a 15-minute RPO and a 4-hour RTO for the archive; the backup window is 22:00-06:00. After adding three scanners, the backup window now runs to 09:40, replication lag reaches 3 hours, and a ransomware tabletop showed that restoring a 20 TB study set from the StoreOnce would take 11 hours. The network team says the 10GbE links are at 70 percent average utilization but 95 percent at peak. Radiology refuses to accept longer downtime. The CISO wants an immutable copy that is not reachable with domain administrator credentials.
1. Calculate whether the current 10GbE backup and restore design can meet the 8-hour backup window and 4-hour RTO. What data would you collect to confirm the bottleneck?
Read the worked answer
A 10GbE link has a theoretical payload rate of about 1.25 GB/s, or 4.5 TB per hour at line rate. A full 180 TB backup therefore needs roughly 40 hours at theoretical line rate, far beyond the 8-hour window; even a 20 TB restore needs about 4.4 hours at theoretical line rate and longer at realistic efficiency. The observed 11.7-hour backup and 11-hour restore confirm that the design cannot meet the SLA as a full-copy process. Collect job-level throughput, changed-block rate, StoreOnce ingest rate, array snapshot size and change rate, link utilization and errors, and restore throttling settings. A 70 percent average with 95 percent peak utilization suggests the link is a constraint, but the restore time may also be limited by StoreOnce disk or by restoring through the same production path. The correct conclusion is to move to incremental-forever backups and local snapshot restores, not simply to add a bigger pipe.
2. Redesign the protection architecture to meet 15-minute RPO, 4-hour RTO, and the CISO's immutable-copy requirement. Explain the dependency chain.
Read the worked answer
Use array-based snapshots every 15 minutes for the archive, with a retention policy that covers the clinical recovery points. Replicate changed blocks to the DR array so the 15-minute RPO does not depend on the nightly backup job. For the 4-hour RTO, restore from the local or DR snapshot first, not from the backup appliance; keep the StoreOnce copy for longer retention and ransomware recovery. Make the StoreOnce copy immutable for the required retention period and place its management credentials in a separate administrative domain from production Active Directory, so a compromised domain admin cannot delete it. Test a 20 TB restore from snapshot and measure actual time, including mount, file system check, and DICOM index rebuild. If the DR link cannot carry changed blocks within 15 minutes, add bandwidth or use selective replication for high-value studies. The backup window then becomes a secondary copy window, not the primary RPO mechanism.
3. What would you test in a ransomware recovery exercise, and what pass/fail criteria would you set for clinical and security stakeholders?
Read the worked answer
Test three separate recoveries: a single deleted study from a local snapshot, a 20 TB study set restored after a simulated array ransomware event, and a full DR activation after loss of the primary site. Include the DICOM index and worklist, not just file restore, because clinicians cannot use orphaned files. Pass criteria should be measurable: restore of the 20 TB set in under 4 hours, snapshot recovery point within 15 minutes of the simulated attack, no use of production domain admin credentials, and documented evidence that the immutable copy cannot be deleted by the compromised account. Also test the decision chain: who declares an incident, who authorizes restore, how radiology is notified, and how studies are queued during the outage. Security should verify that the backup management plane is isolated and that restore logs are retained. A tabletop alone is insufficient; the exercise must include an actual restore and a timed clinical validation of image access.