Ransomware-Resilient Backup with StoreOnce and Cloud Copy
Global Manufacturing has 300 TB of VMware VMFS and 40 TB of SQL Server data at its primary site. A ransomware attack at a subsidiary encrypted 18 TB of file shares; backups were on the same domain and were also encrypted. The board requires RPO 60 minutes, RTO 4 hours, 60-day immutable copies, and an air-gapped copy at a second site 250 km away. The company owns an HPE StoreOnce 5260 appliance at each site and uses HPE Backup and Recovery Service for cloud copies. Security requires AES-256 encryption at rest, TLS 1.3 in flight, separate backup admin roles, and no production credentials on the backup server. They propose a single StoreOnce Catalyst store with a 60-day retention lock, backups over the production LAN, and the same domain admin account for backup and restore.
1. Identify the gaps in the proposed backup design and describe the corrected architecture.
Read the worked answer
The single Catalyst store is a gap: a working restore store and an immutable long-term store should be separate so retention locks do not block normal operational restores and expired data can be handled safely. Retention lock must be enabled in a mode that prevents even administrators from deleting protected copies before 60 days, with a documented exception process. Backups over the production LAN expose backup traffic to the same attack surface and congestion as production; use a dedicated backup network with restricted ACLs. The same domain admin account for backup and restore is a critical flaw: compromise of the backup server would give domain-wide control. Use separate least-privilege service accounts, MFA for interactive administrators, and role separation between backup operators and restore approvers. For air gap, replicate to the second-site StoreOnce and to the cloud copy, but ensure the cloud copy is immutable and uses separate credentials. Test a restore from the second site without relying on the primary domain.
2. Given RPO 60 minutes and RTO 4 hours, propose a backup schedule and validate whether the WAN and restore path can meet the objectives.
Read the worked answer
Take hourly VMware incrementals and SQL log backups every 15 minutes to meet the 60-minute RPO; run a daily synthetic full to avoid repeated full backups. Keep the most recent 7 days on the local StoreOnce for fast restores, replicate to the second site asynchronously, and retain 60 days immutable in the long-term store and cloud. For the 40 TB SQL estate, log shipping frequency matters more than full backups. Size the WAN from change rate, not raw capacity: if daily change is 5%, 17 TB per day must replicate, which is about 1.6 Gb/s sustained if compressed into 24 hours; use change-rate throttling and initial seeding. For RTO 4 hours, restoring 18 TB in 4 hours requires about 1.25 GB/s, or 10 GbE, at the restore target, so validate the second-site network and StoreOnce read performance. Test a full site-loss restore, not just a file restore, and include the backup catalog in the recovery plan.
3. What encryption and access controls are needed to satisfy the security requirements without breaking restore capability?
Read the worked answer
Encrypt data at rest with AES-256 and protect keys in an external key manager separate from the backup data and separate from the production domain. Use TLS 1.3 for backup traffic and replication; disable older protocols. If the StoreOnce platform provides native encryption, enable it with KMIP and test key availability during restore. If native encryption is not available for a data path, encrypt at the backup application before the data reaches StoreOnce, but document the key-recovery process because losing keys loses backups. Implement role-based access: backup administrator, restore operator, security administrator, and auditor. The backup server must not use a production domain admin account; use a managed service account with least privilege and restrict it from production file shares beyond the backup paths. Enable immutable retention, alert on deletion attempts, and require dual approval for retention changes. Finally, test restore using only the backup role and external key manager to prove the controls do not block recovery.