Ransomware-Resilient Backup for a Regional Hospital
A regional hospital has 250 TB of primary block and file data across an EHR cluster, PACS archive, and general file services. Daily change is about 20 TB, and the current backup window is six hours. Clinical policy requires 30 days of operational recovery and seven years of PACS retention. The hospital has two data centers 30 km apart, a 1 GbE inter-site link, and a 10 GbE backup network. The existing backup software writes nightly full backups to a single HPE StoreEver MSL tape library; restores of a 2 TB EHR database took 11 hours last month, and the CIO is worried about ransomware. The security team requires an immutable or air-gapped copy, role separation, and at least one copy that cannot be deleted by a compromised backup administrator. The infrastructure team proposes either HPE StoreOnce with Catalyst and Cloud Bank, HPE Zerto, or both, but has not sized the target or defined RPO/RTO. The hospital wants a defensible design, not a product list.
1. Size the StoreOnce target and justify the dedupe assumption. State logical vs usable capacity and why you would not promise a fixed ratio.
Read the worked answer
Logical retention: 250 TB full + 29 daily incremental sets at 20 TB = 830 TB, before any PACS long-term growth. If you model 30 daily full-equivalent copies, it is 850 TB. Do not promise a fixed dedupe ratio. EHR databases and SQL may dedupe 8-12:1; compressed PACS images may be 1.5-3:1; file shares vary. A blended 5:1 assumption gives 850/5 = 170 TB; 8:1 gives 106 TB. Add 20-30% for metadata, growth, and free space: a 130-220 TB usable StoreOnce target is a defensible planning range, but the exact model must come from HPE sizing. Better: split the design. Put EHR/SQL backups in a StoreOnce Catalyst store with a conservative 8:1 assumption; put the seven-year PACS archive on tape or object storage, because medical images are already compressed and long retention on dedupe disk is expensive. Validate with a sample data set or PoC. Treat the ratio as a capacity-planning assumption, not a guarantee.
2. Design the ransomware-resilient architecture and assign RPO/RTO for EHR, PACS, and file services. Explain why snapshots alone are insufficient.
Read the worked answer
Tier the protection by workload. EHR: use HPE Zerto continuous replication to the DR site with a 5-15 minute RPO and a 1-2 hour RTO, plus StoreOnce backups for logical corruption and long retention. PACS: nightly StoreOnce backups plus a seven-year tape or object-lock archive, with a 24-hour RPO and a restore objective measured in hours. File services: snapshots plus daily backups, 24-hour RPO. Ransomware resilience: keep at least one immutable or air-gapped copy, replicate StoreOnce to the second site, and use Cloud Bank to an object-lock target for a third copy. Separate credentials and roles so the backup administrator cannot delete the immutable copy; enable MFA, audit logs, and alerting. Test a clean-room restore. Why snapshots alone are insufficient: they live on the same array and use the same administrative control plane; a compromised admin or array loss can delete or corrupt both the production data and its snapshots. They also do not provide the required retention or air gap. The design should follow 3-2-1-1-0: three copies, two media, one off-site, one immutable/offline, and zero errors verified by restore tests.
3. The 1 GbE inter-site link is the only WAN. What replication and seeding approach do you recommend, and what will you tell the CIO about meeting RPO?
Read the worked answer
Do the arithmetic before promising RPO. 20 TB/day is 20,000 GB / 86,400 s = 0.23 GB/s, or about 231 MB/s average. A 1 GbE link is about 125 MB/s theoretical, so an uncompressed, undeduplicated continuous copy cannot keep up. With 5:1 dedupe/compression, the average falls to about 46 MB/s, which fits; with 2:1 it is about 116 MB/s, which leaves almost no headroom. For a 15-minute RPO, the logical 15-minute change is 20 TB / 96 = 208 GB, or about 222 MB/s; at 5:1 that is 44 MB/s, but burst overhead can still saturate 1 GbE. Recommendation: seed the second site by co-locating the StoreOnce appliance or using physical media, then replicate only deduplicated changes on a throttled schedule. For Zerto, protect only the EHR tier at a 15-minute RPO and measure actual change rate; do not assume all 20 TB changes daily. If the measured unique change exceeds about 8-10 TB/day, ask for a 10 GbE upgrade or relax the RPO. Tell the CIO that RPO is workload-specific and must be validated by monitoring, not promised from the daily change figure alone.