Executive Overview:
Veeam University Hospital is a healthcare network with located is Boston, Salt Lake City and Columbus. They are considered a pioneer in breakthrough treatments to many illnesses and recognized worldwide as a leader in their field. They have decided to modernize their data protection strategy due to new regulatory requirements as well as ever evolving malware issues. They suffered a ransomware attack recently as well, which affected several systems with patient treatment.
Furthermore, they have expressed interest in replication of virtual workloads between sites in case of a disaster to allow for timely failover between sites with would ensure continuity in the level of patient care offered.
Their board of directors is concerned that all virtual workloads at this point can be considered a single point of failure.
Veeam University Hospital has also been experiencing issues with the time required to back up NAS systems. Not only are they taking too long, the amount of space required is considered excessive, and a reduction of storage space for these backups is desired. Veeam University Hospital had issues with the time required to restore Exchange items. The current solution will only restore entire mailboxes, and no granularity is possible. For this implementation to be successful, backups must complete in the allotted backup window, and the recovery of data should be faster than the current solution, which can amount to 24 to 48 hours for a full system restore.
Solution Concept:
Veeam University Hospital is replacing their current backup solution Veeam. They plan to protect data at all three sites, with backups copied off-site for disaster recovery purposes. They have also expressed an interest in taking action to prevent another data lost due to ransomware. The offenders were also able to encrypt the existing backups as part of the attack, so data recovery is impossible. Veeam University Hospital is also interested in any posible public cloud technologies that might help mitigate this risk.
In addition, replication of running workloads to secondary sites will also be implemented to allow for site failover in the event of a disaster for reduced down time.
Existing Technical Environment:
Veeam University Hospital has VMware cluster in all locations. For security purposes, each cluster is dedicated to the department that it servers. No communication between cluster is possible. These cluster are broken into two categories, one hosting database workloads and the other hosting general use virtual machines.
Confidential patient data exists on several NAS systems as unstructured data. These NAS systems are only presenting backups to ensure consistency of the database. Veeam University Hospital has an in-house patient database required a custom script to be execute before backups to ensure consistency of the database.
MSSQL and Oracle are used by most of the departments, with a mix of virtual and physical deployments.
Each site as a 10 GbE link to the public internet, and all traffic between sites is routed through these connections via VPN.
Each site has 20 vLANs in use, with 16 being used for VMware workloads. For security and regulatory purposes, all vLANs are firewalled off from each other.
The current backups write to NFS storage.
All doctor and lab staff are assigned their laptops, which will also need to be protected. The location of data on these devices is enforced through group policy, and consistent throughout the organization.
No current disaster recovery solution, apart from restoring from backup files, exists at this time.
Business Requirements:
Any new solution must take advantage of automation and self-service functionality. Both features are needed to cut down on administrative costs. Role based access (RBAC) is mandatory. For example, only Oracle administrators can have the ability to perform self-service restore of Oracle Data. Mission critical applications must not be impacted during business hours. All backups must complete between 6 p.m. and 8 a.m. local time.
To meet regulatory requirements all data must be retained for three years. For archival purposes, 12 monthly backups and three yearly backups must be stored offsite. Veeam University Hospital will only purchase on-premises storage to accommodate growth for three years of backup retention.
For any replicated virtual workloads, the data must not more than one hour old. Due regulatory requirements, all protected data must be encrypted in flight and rest. To meet customer service-level agreements, a commercially available helpdesk ticketing system is in use. All alerts generated must be integrated with this system to create support tickets.
Technical requirements:
Backups must take advantage of public cloud storage for long term archival purposes. The solution must keep a local backup and be able to create an additional copy of production data. Both backups should reside on site with production systems being protected. For quick restores and recovery, at least copy of protected data must reside on-premises. Due to the threat of ransomware, at least one immutable or air gapped copy of protected data must reside off-side.
To ensure data integrity, backups must be verified and scanned for malware before any restore Is performed.
In addition to Self-service Oracle restores, native Oracle tools must be available and PowerShell script ready to perform ad-hoc backups and restores.
The backup solution must support VMware encrypted datastores. Backups must be stored in logical scalable storage systems that can be expanded non-disruptively. For end user laptop backups, only user data should be backed up. Operating system files should be excluded.
Personal files such as music, photos, and videos must be excluded for backup.