DATA PROTECTION SOLUTION BRIEF - StorageCraft · All backup data is verified when stored and re-verified at regular intervals ensuring your backups can be used in case of a disaster

DATA PROTECTION SOLUTION BRIEF

GET YOUR RANSOMWARE DEFENSES IN PLACE TODAY


2

Rebounding from Ransomware Attacks

Keeping ransomware out of your environment calls for balance between your cyber security strategy and business continuity plan. Firewall and anti-malware solutions should be in place doing their jobs. If you do experience a breach, you need to have a complete set of processes ready to restore operations as quickly as possible.

To keep data safe and protected from ransomware attacks, StorageCraft offers the best-in-market offsite backup solution for Windows, Linux and mixed environments. This way, you can restore your system from the most recent secure backup image without paying ransom and with minimum downtime.

QNAP NAS Linux-based QTS operating system makes it more secure than Windows® systems which are more at risk from being attacked. Moreover, the native support for point-in-time snapshots which are operated separately from the file system, makes QNAP NAS a reliable backup repository that reacts quickly for backing up and restoring important files and system data.

Ransomware is real, and it’s spreading. It can do real damage if it infects your systems. At the same time, you can cut your risks dramatically with a comprehensive backup and recovery plan. Take the right steps now and make it a priority to get a comprehensive recovery solution in place. You’ll get the last laugh on the hackers and you can spend the ransom money on something better.

Get your ransomware defenses in place today!

This solution brief is designed for environments with 1 to 20 servers (physical and/or virtual) to be backed up and describes the setup and configuration of all components involved.


3

Benefits ■ Protect both physical and virtual servers with the same technology.

■ Agent based backup technology ensures consistent backups are taken with minimal impact on performance.

■ Storage Efficient Backups every 15 minutes ■ After initial full only block level delta backups are taken.

■ Continuous (re)verification of data ■ All backup data is verified when stored and re-verified at regular intervals ensuring your backups can be used in case of a disaster.

■ Multiple replication options ■ Use one of four replication options to securely store a copy of your backup data off-site. StorageCraft Cloud Services also provide Disaster Recovery capabilities in the cloud.

■ Centralized management and monitor.

Requirements ■ On each server that will be backed up you need to install StorageCraft SPX.

■ A QNAP TS-453A 8 GB will be uses as local target to store and manage all backup data.

■ Optionally, we can replicate data from one TS-453A to another TS-453A to get a copy of the backup data to a second site for Disaster Recovery purposes.


4

Configuring the QNAP TS-453A NASFor this, we assume that you have gone through the initial setup of the QNAP (setup networking, storage and user accounts. You need to create at least 2 volumes, one which holds the backup data and another to be used for Virtualisation. Also make sure Virtualization Station 3.0 is installed and configured

Step 1: Create a share on the TS-453AOpen the management console for the TS-453A, go to FileStation and click “Shared Folder”.

Provide a name (we will use SCBackup in this example) and description for the new share.

Step 2: Modify share settingsTo enhance security for our backups and prevent unauthorized access to the backup data make sure deny Guest access and hide the share.


5

This concludes the setup for the shared folder to hold the backup data. Next step is to configure StorageCraft ImageManager.

To ensure the data on the backup share can only be accessed by authorized persons we will only allow the BackupAdmin account RW access on this share, and revoke read/write permissions for all other accounts. Click Create when done.

Step 3 : Configure Snapshot settingsIn StorageManager select the volume that holds the backups and click on SnapShot-> Snapshot Manager. Create a snapshot schedule that will take a snapshot once per day at 23:50. This way we will capture all backup data of the past working day in a snapshot before the data is being processed and consolidated. Set the retention for snapshot to keep for 1 week.


6

Installing and configuring ImageManager

StorageCraft ImageManager is an essential part of the complete data-protection solution, as it takes care of Verifying, Consolidation and Retention of your backup Images. Preferably, this needs to run on a dedicated (virtual) Machine in the protected environment.

Through Virtualization Station the QNAP TS-453-A has the ability to run a virtual machine on the NAS itself. For this solution, we will utilize this feature, and install ImageManager on a VM running on the QNAP NAS. By using this feature you will have all components required for storing and managing your backup data on a single device, and no additional hardware is required. This simplifies your total setup and reduces total management overhead

For setting up Virtualization Station on the QNAP we refer to the on-line documentation. Next step is to create a new virtual machine.

Step 1: Creating a new VMOpen Virtualization Station and click on Create VM. Assign 2 CPU cores and 4 GB of memory to the machine. Point the CD image to an iso of the Windows OS version you wish to use for the ImageManager (for our example we have installed Windows 2012R2, but a workstation OS such as Windows 8 or 10 works as well). Select the location for the virtual HDD and set the size to 100 GB. Make sure this is on a different volume than the backup data.

Once the OS is installed we will need to install ImageManager.


7

Step 1: Install StorageCraft ImageManagerDownload ImageManager from the StorageCraft website (https://www.storagecraft.com/downloads/trials-updates) and install the software on the virtual machine on the QNAP. For the install just accept the defaults, accept the license agreement and set the language to English.

Once the install is complete a reboot of the VM is required.

Step 2: Create Backup folders for all servers being backed upOpen FileExplorer and for the file location type \\QNAP-453A\SCBackups. Keep in mind that as this was created as a hidden share it will not show up when you browse the network. To connect enter the credentials for the BackupAdmin account.On the share, create a folder to hold the backups for all servers. In this example, we will create a folder called MyBackups. Inside create a subfolder for each server you want to backup. In this example, create a subfolder “TEST1”.

Step 3: Configure ImageManagerStart ImageManager. As this is the first time you start the software you will need to change the password. Enter the password you would like to use for ImageManager and click OK.


8

Next at the left hand side select Agents settings. Make sure ImageManager Processing time is set to run shortly after midnight, e.g. 12:10 AM. Set Default Folder Credentials to match the credentials for the BackupAdmin account

On the Global Retention tab you can configure the setting on how long ImageManager should keep consolidated files. In the default settings we will keep intra-daily files for 7 days. Consolidated daily files will be kept for 15 days, and consolidated weekly files will be kept for 30 days. Depending on your requirements, you can decide to keep all consolidated monthly files forever, or consolidate monthly files as well.

To ensure you are not running out of storage space we recommended to uncheck the option to move all consolidated image files.

We can leave all other settings to their default values, so click Save to close this screen and save all settings. More information on the retention process and settings can be found in the ImageManager documentation.


9

Step 4 : Configure Managed FolderIn ImageManager click on to create a new managed backup folder. This will open the following window:

For the folder path provide the path to the folder which will hold the backups on the TS-453A. Use a description if you want to make your life easier when identifying multiple backup locations. Next, make sure you set the folder type to Backups Store. This will ensure all subfolders (one for every additional server being backed up) will be managed automatically.

Set the option for “This folder requires authentication” and select the Use default folder credentials. Leave all other settings at their default for now and click on Save.ImageManager adds the selected folder to the folder list, and if all is configured properly, it picks up the subfolder that was created for server TEST1

This concludes the required configuration of StorageCraft ImageManager.

Optionally you can configure notification settings, which will send out status information, warnings and alerts via E-Mail to a preconfigured E-Mail address. More information on this can be found in the ImageManager user manual.


10

Installing and configuring ShadowProtect SPX.

ShadowProtect is the component that will backup your servers (and data). Download ShadowProtect from the StorageCraft website (https://www.storagecraft.com/downloads/trials-updates) and install the software on the machines you need to backup.

Step 1: Install StorageCraft SPXInstall StorageCraft SPX on all machines (physical and/or virtual) that need to be protected. Make sure you install both Agent and Console software :

See the SPX manual for prerequisites and detailed instructions on how to install the software. You can accept default settings for now. Once installed the machine needs to be rebooted for the agent to become active (without the reboot it is not possible to run backups).

Once rebooted start the SPX console and logon using an account with at least local admin privileges. After logon, you will need to provide a license key:

Make sure a valid license is applied, as without a valid license no backups will be performed. This can be a full license, or a 30 day trial license (click on Get Trial Key to get your free 30 day key)


11

Step 2: Create Backup DestinationBefore we can run backups we first we need to create a backup Destination within SPX. Click on . The Destinations window will open. Now click on Add. A new window will open. Provide a name for the destination, we will use “QNAP-TS453A” in this example, and set type to Network Share. Enter the path to the backup destination. In this example this will be:

\\QNAP-TS453A\SCBackup\MyBackups\Test1

Provide credentials to access the share on TS-453A

Click on Verify Access to ensure network path and credentials are correct. If correct SPX will confirm. Click Save, and in Destinations click Done.

You have now created a backup destination, which uses the backup folder for this server on the QNAP where ShadowProtect will store all backup data.


12

Step 3: Create new Backup JobCreate a new Backup Job by clicking . Or click on Backup -> New Job.

A new window will open. On the settings tab provide a Job name, in this case we’ll use “BackupAllData”. As we have only one destination configured (QNAP-TS453A) this is already filled in, but can be changed if needed. Leave compression at default setting of Standard. We strongly recommend to enable 256 bit encryption on all backup jobs so a password for the backup needs to be provided.

In Volumes select all volumes that will need to be backed up.

We also recommend to modify the Image File Name and add the server name in front of the volume name. This will simplify management at later stages. Simply click on the name, e.g. R_VOL, and change it to TEST1_R_VOL. Repeat for all volumes.

Next a schedule needs to be configured on the Schedule Tab. In this case we will select Continuous. This will give you the best backup performance, as it will perform block level incremental backups once we have taken a full base image first.

The default schedule will take backups every hour on working day from 08:00 until 18:00. The schedule and frequency can be changed to match your requirements. In this scenario we recommend to have a window in which no backups are running as this will give best performance for managing and replication of data.


13

In case hourly (or more frequent) backups are also needed outside working hours we recommend you contact a StorageCraft partner for a proper sizing of the different components.

On the advanced tab, all settings can be left at their default values. We only recommend enabling the option “Use write cache when saving files” as in most cases this will increase backup performance.

When ready click on save. The backup job will be created, and will run at the next scheduled time.

If required, the start of the job can be forced by right clicking on the backup job and clicking on Start Backup Now.


14

In the above screenshot you can see ImageManager has picked up the backup files and is verifying them

As this is the first time it will trigger a full backup, so this might take some time to complete. Throughput will depend on many factors, but speeds of 50 to 90 MB/s over 1Gbit networks should be achievable.

Step 4: Verify Backup OperationsVerify backups are created by monitoring the backup folder on the QNAP TS-453A. In the folder that was created for the server being backed up you will find the following files:

*.SPF Base image for the volumes being backed up.*.SPI Continuous incremental backups for the volumes being backed up.*.spk Keyfile.*.md5 MD5 hash for every data file being created, used to re-verify the data.

Step 5: Verify ImageManager OperationsOpen ImageManager to verify backup data is being processed correctly. If all is working as expected ImageManager will have detected the subfolder for the newly added server.


15

How does this work together?

As you now have seen StorageCraft SPX takes multiple backups per day (1 every 15 minutes in this example) from one or more servers and stores these (incremental) backup in a share on the TS-453A.

Directly after the backup files, ImageManager verifies the backup data by recalculating the MD5 hash and comparing it with the original MD5 hash. Data is only considered valid if these match.

At 23:50, the TS-453A takes a snapshot of the backup data. This means we have now not only protected the data from all servers, but even the backup data itself is now protected from potential corruption through viruses, malware or crypto lockers, as the data in the snapshot cannot be tampered with anymore.

In this example, we have configured TS-453A to keep a maximum of 7 snapshots which allows us to go back to previous backup sets up to 7 days ago in case of corruption of the backup files themselves. This will also help you in case an infection with e.g. a crypto locker is not detected immediately, but maybe after one or two days, when this is happening over the weekend.

If the backup files are not compromised, StorageCraft with its default settings will allow you to go back to any point in time within the last 7 days as well with a granularity of 1 hour, and to any day between 7 and 15 days ago. This granularity ensures you will only have minimal data loss in case of a disaster.

At 00:10, StorageCraft ImageManager will start the consolidation process. This will capture all changes of the day from all *.spi files and consolidate these changes in to a consolidated daily file. If the software has been running for a longer period, it will also start to create consolidated weekly files at the end of every week, and consolidated monthly files after 30 days. This ensures a fast recovery in case of a disaster, as we do not need to go through every single incremental backup file, but will use the shortest path possible.

Furthermore, ImageManager will re-verify all backup data every 7 days. This ensures your will be able to restore data when you need to.


16

Getting data off-site

As mentioned before a key component of every disaster recovery solution should be to have a copy of your backups on a secondary location. Replication provides additional safeguards for disasters such as theft of equipment or destruction of servers and/or storage through fire, flooding or other natural disasters. Finally having a device that is isolated from the main backup environment is yet another layer of defense against malicious virus or cryptolocker attacks

With the combined solution of StorageCraft and QNAP you have multiple options to realize this. Below we will describe the two most common scenarios.

Use TS-453A replication

First option is to set up replication directly between two TS-453A devices using the Snapshot replication feature of the QNAP. In this scenario every evening at 23:50 when the TS-453A takes a snapshot a copy of this snapshot (or to be more precise, only the unique data in the new snapshot) is replicated to the second TS-453A. As the replication is linked to the snapshot time of 23:50 this will also ensure that the bulk of replication will happen outside of working hours, thus having a minimal impact on performance in your environment.

The biggest advantage of this scenario is that apart from a second TS-453A on your DR site no additional hardware or software is required. The trade-in for this simplicity is that retention of backup data is equal on both sites, and apart from the safeguards within the TS-453A OS there is no additional verification of the backup data on the DR site.

The data on the replica device is an exact point in time copy of the primary device, and data from this device can be used to restore data in exactly the same way you would use the data from the primary device.

To prevent having to send all data for the initial synchronization over the internet connection between the main site and the DR site you could start with having both TS-453A devices on the same location and network, and only move the second device to the DR location once the initial sync is ready. This does require some additional configuration of the ReadyDR job once the device has been moved.

If there is enough bandwidth and time, you could start with the second device on the DR site and run the replication directly over the internet.


17

Use ImageManager ReplicationThe second option would be to set up replication using StorageCraft ImageManager. In this scenario, StorageCraft ImageManager controls the replication, which gives you more control over your replication. You can choose to replicate all backup points, or just the consolidated daily and weekly recovery points. In addition, there are more options to control bandwidth. ImageManager will use (S)FTP to transfer the data between the main site and the DR site, so there is no need to set up a VPN tunnel.

This setup can be used with or without a second ImageManager running on the DR site. If no ImageManager is used the replica data will be a copy of the primary backup data with identical retention and no additional verification. In this scenario, we will write data directly to a TS-453A share which has the FTP protocol enabled.

If you do run an ImageManager on your replica site (which by the way can be done the same as on the primary site, installing ImageManager in a virtual machine directly on the QNAP). You will be able to set up different retention and consolidation schedules as well have additional verification of the data. If the machine running ImageManager is powerful enough you can even run a virtual copy of your most important servers using either VirtualBoot or HeadStart Restore to keep you up and running even in case of a disaster. More information on the use of these features can be found in the ImageManager user guide as well as on the StorageCraft website.

ImageManager also allows for the creation of seeding drives so the initial base images doesn’t need to be send over the wire, but can be moved from the main site to the DR site using an external USB disk.


18

To configure replication using ImageManager please perform the following steps:

Step 1: Configure FTP on target siteCreate a share on the target (replica) NAS and enable FTP Services via the QNAP control Panel.

Step 2: Setup replication in ImageManager.In order to set up (S)FTP replication open StorageCraft ImageManager on your primary site, select the server for which you want to replicate data and click on . A window will open in which to configure the settings. First, enter a name for this replication set. Under destination, for type select IntelligentFTP. In Location, select <Add new location>. In the locations settings screen provide a name for this location. Provide the path to the FTP server, for this example we have used the IP address of the FTP server, but you can also use a FQDN. Select the option for authentication, and provide a username and password (as configured on your FTP server). Click Save

If needed you can limit the bandwidth used for this job by enabling the Override global throttling, and set a limit for this job. By default, the job will not replicate the base image over the wire and you will need to use a seeding drive. If you have enough bandwidth you can unselect this option, in which case all data will be send to the Replication Target over the wire.


19

To seed the replication the base images for the machine you are protecting (*.spf files) will be copied to an external (USB) drive and on the remote site they will be imported to the share holding the backup data.

As we will have an ImageManager on the DR site, we need to configure the replication job accordingly. On the Replication mode tab you can select to either replicate only consolidated intra-daily image files, or only the original intra-daily image files.The first option you will only transfer one file per day (at 00:01 as per ImageManager setting), while with the second option image files will be transferred every time a backup has been taken.

We have now successfully configured replication, and you will have a copy of your backup data off-site once the base image has been imported and the first incremental jobs have finished


20

Step 3: Configure ImageManager on the DR siteAs a last step, we need to configure the ImageManager in the remote location to start managing the replicated data. This will ensure data integrity is checked (we will verify the MD5 hash on every incoming file, and periodically every 7 days) and as we have selected to replicate unconsolidated intra-daily image files ImageManager needs to run consolidation as well. The benefit we now have is that we define different settings for consolidation and retention on the DR site.

The procedure is the same as setting up a new managed folder on the primary site as described in Step 4. So follow the steps as described above. Make sure that you set the folder type to Backup Store, so ImageManager will pick up new folders for replicas automatically.

This concludes the setup of your DR site.

What are the benefits of running an ImageManager on the replica site

StorageCraft offers many ways to recover your data, from a simple recovery of single files or folders directly from the backup image up to spinning up a copy of the protected machines (Virtual Boot), or even having a copy of the machine ready to go (HeadStart Restore). Furthermore, the integrated integrity checks of ImageManager will ensure that you replicas are ready to use when disaster strikes.

Having a copy of your backup on a second site ensures you can always recover, no matter the disaster that hits you. From a simple human error to a total loss of your IT infrastructure due to flooding or fire, you can rely on your replica to help you bring back your most important servers in minutes, rather than hours or even days.

No more juggling with tapes or external USB drives to get your data off-site, StorageCraft replication will ensure data is securely moved off-site.


21

Using StorageCraft Cloud Services for Recovery

With StorageCraft® Cloud Services™ you will have the tools you need to quickly get running again should your business experience a major local disaster. StorageCraft Cloud Services stores your backups remotely so you are ready for the worst. Recover data, even virtualize your machines and re-create your network in our cloud purpose-built for disaster recovery (DR).

Customize your cloud configuration to fit your environment and budget needs. As a StorageCraft Cloud user, you will enjoy:

■ Low setup, management, and overhead costs

■ Control over your own cloud settings and recoveries

■ Predictable monthly pricing

■ No further investment in additional hardware for DR, all is included in our monthly fee

Setup StorageCraft Cloud Services can be configured in just a couple steps:

Step 1: Create a Cloud Services AccountLogin to the StorageCraft Partner Portal, select Cloud Services and click on Add Cloud Account. Enter an Account Name, Username and Password, and select the Account permissions for this account. In this case, we will allow all actions.


22

Step 2: Configure Replication to the CloudIn ImageManager select the folder for our Test1 server being backed up, Right-click and select create job -> Replication. Set the Destination Type to StorageCraft Cloud Services.

In the locations drop-down select <Add New Location>. Name the Location (e.g “QNAP Cloud Target”) and provide username and password as defined in step 1 and click Save.

On the replication Mode Tab, you have the option to either replicate only consolidated Backup Images (recommended), or to immediately replicate intra-daily images. The first option requires more bandwidth, but ensures you have more granular recovery options in the cloud, while the second option optimizes bandwidth usage and performance

On the cloud Settings tab select the service level you want. There are 3 options:

■ Cloud Basic - Stores a copy of your backup data in the cloud

■ Cloud + - As above, but allows for browsing and downloading files/folders

■ Cloud Premium - As Above, plus the ability to start up a copy of your protected server(s)

After configuration, ImageManager will start replication data to the StorageCraft Cloud.


23

Step 3: Verify settings in StorageCraft CloudOnce replication/upload to the cloud is complete, login into the Partner Portal and verify data for the selected machine has been uploaded correctly:

Once uploaded you have several options to recover your data, or to start your machines in the cloud for almost instant Disaster Recovery!

For more information, please check or website:https://www.storagecraft.com/products/cloud-services


24

StorageCraft VirtualBoot

StorageCraft® VirtualBoot™ technology boots a backup image of a system volume into a virtual machine (VM). Anytime you need to quickly virtualize a system that is protected by our backup software, VirtualBoot is the tool you use. Use VirtualBoot in these scenarios:

Testing backups

You can boot a backup image into a virtual machine to make sure a restored system would function properly. VirtualBoot loads the operating system, applications, and data into the VM, thus giving you a reliable and speedy way to regularly verify that your backups work as expected.

Temporary system failover

Restoring a large system can take a lot of time, but virtualization can help. In just a few minutes, you can create a temporary VM of a failed server with VirtualBoot to tide you over. It still has our backup software installed and can continue to back up the system, thus protecting any new files or folders.

Software testing in a virtual sandbox

When you want to test a new application (or upgrade an existing application), you can use VirtualBoot to launch a VM of the production system’s latest backup file and install the application on the new VM. You can then evaluate the software performance within your actual IT environment but without any risk to your production system.

Historical data access

Many data files require specific software to open them. When you need access to old data (such as during an investigation or audit), and you no longer have the application that opens these data files, you can use VirtualBoot to boot an archived backup image. The VM will contain both the data needed and the application that opens the files.

Seamless recovery and migration (for vSphere)

Opt to permanently recover or migrate a physical system or VM (of any flavor) to an ESXi host (requires a vSphere cluster). This is possible because you can choose to have the data from the backup images written directly to the .VMDK file. After migration is complete, the new VM operates independently of the original system’s backup image files


25

StorageCraft HeadStart Restore

StorageCraft® HeadStart Restore® (HSR) technology lets you start a restore operation before a disaster hits. Should a server fail, a pre-staged restore operation greatly reduces downtime, especially when multi-terabyte systems are involved. Migrate or restore in the time it takes to reboot a server. Use HeadStart Restore in these scenarios:

Hardware Failure

While you repair a downed database server, the business will not even notice it’s not available. Employees can still access the database because you have set up a temporary virtual machine (VM) with StorageCraft VirtualBoot™ technology. In this VM, changes to the database will continue being recorded and stored in incremental backups. You would then set up an HSR to the repaired database server. Once the most recent incremental backup from your temp VM is applied to your repaired server, finalize the HSR job, take the VM down, and bring up the database server—as if nothing happened (as far as your clients know, that is).

Planned Migration

Migrate a 2TB database server to a new environment without needing three days of downtime to get it done. While your database server continues to run, use HeadStart Restore to send a full backup image of this server’s disk and subsequent incrementals into a VM file. Once you’re ready to switch over, you’ll then apply the most recent incremental backup to your new server and bring it online. Use StorageCraft Hardware Independent Restore™ technology to get the migrated operating system to boot on the new machine.

Virtual Standby

Be prepared with a standby if your primary server fails. You can set up HSR to create your standby volume as a virtual disk and place it on an ESXi host. If the server does fail, then you finalize your HSR job (which stops adding changes to the volume) and reboot (with the help of the StorageCraft Recovery Environment). Bring your standby copy online as a replacement for the failed primary server.

Documents

DATA PROTECTION SOLUTION BRIEF - StorageCraft · All backup data is verified when stored and re-verified at regular intervals ensuring your backups can be used in case of a disaster