Introduction
Delphix provides a base feature set that is strong as a data protection platform in itself, while striving to introduce enhancements that prevent snapshot and database loss in the event of a ransomware attack.
The Delphix Data Vault for ransomware protection (accessible via CLI) enables organizations to recover access to their application data much faster than traditional backup solutions after malicious attacks. It relies on the new Data Vault Replication feature, which replicates critical business DB data stored on Delphix engines to a new target engine called Data Vault. Once securely stored on the Data Vault, the replicated DB data can be used to recover business applications upon a ransomware attack with very low RTO and RPO.
Requires Technical Services Consult
Delphix requires a Technical Services assessment prior to deployment and configuration of Data Vault. The process of configuring a Delphix Data Vault replication profile is simple; the assessment is required because each application has specific data protection and recovery requirements and we must ensure that Delphix can respond to them appropriately. To schedule an assessment, please contact your Customer Success Manager.
Advantages
The Delphix Data Vault solution provides built-in protection against ransomware attacks by frequently refreshing production application data to a virtual database (dSource), from which you can recover applications almost instantly to any valid point in time prior to the encryption attack by leveraging Delphix VDB provisioning capabilities. The refresh interval between the production application and the Delphix dSource can be configured to be up to seconds, for business-critical applications (not applicable to all DB technologies).
- Creates a separation of responsibilities between the two Delphix Engines
- One engine is used for regular Virtualization cases (ingestion, VDBs, SDD)
- Another engine is used for ransomware protection.
- Creates a physical separation by allowing the admin to isolate and secure the locked Delphix Engine.
- Only the DSP port has to be open for replication.
- No ports are needed for JDBC, NFS, or SSH until VDBs need to be created to export data. This also prevents attack vectors related to any of those protocols.
- Can assist with making deployments and security reviews easier to pass since the locked Delphix Engine is isolated and has a single purpose to reduce potential attack vectors.
In the event of a ransomware attack on the primary engine where a source has been compromised or corrupted, you can provision a VDB on the replica in the locked namespace of the replication target, similar to the normal replication namespace. This process can be further outlined in the Provisioning From Replicated Data Sources or VDBs article. If a complete recovery of the primary engine is needed, please contact Delphix Support.
Implementation
The following points provide an implementation outline of the security improvements offered with Data Vault.
- This feature adds a property to the replication spec and namespace called, “locked”.
- For locked replication specs, additional dSources, VDBs, groups, and domains can be added - but nothing can be removed after doing so.
- If a dSource/VDB is part of a locked replication spec, the dSource/VDB is not allowed to be deleted.
- Failover on the target Delphix Engine is not allowed if the namespace is part of the locked replication spec.
Create a locked replication profile via CLI with the following.
[user.hostname]> replication spec
[user.hostname] replication spec> create
[user.hostname] replication spec create *> set name=locked-spec-1
[user.hostname] replication spec create *> set objectSpecification.objects=Untitled/dbname
[user.hostname] replication spec create *> set targetHost=example.delphix.com
[user.hostname] replication spec create *> set targetPrincipal=admin
[user.hostname] replication spec create *> set targetCredential.password=delphix
[user.hostname] replication spec create *> set lockedProfile=true
[user.hostname] replication spec create *> commit
`REPLICATION_SPEC-3
[user.hostname] replication spec> select locked-spec-1
[user.hostname] replication spec 'locked-spec-1'> get
type: ReplicationSpec
name: locked-spec-1
automaticReplication: false
bandwidthLimit: 0
description: (unset)
encrypted: false
lockedProfile: true <------------------------------ LOCKED
numberOfConnections: 1
objectSpecification:
type: ReplicationList
name: (unset)
objects: Untitled/dbname
reference: REPLICATION_SPEC-3
runtime:
type: ReplicationSpecRuntime
schedule: (unset)
tag: 5570be25-dbcf-48c3-b2d2-dd2c65eb98b7
targetCredential:
type: PasswordCredential
password: ********
targetHost: example.delphix.com
targetPort: 8415
targetPrincipal: admin
useSystemSocksSetting: false
[user.hostname] replication spec 'locked-spec-1'> cd ..
[user.hostname] replication spec>
To lock an unlocked replication profile, use the following.
[user.hostname]> replication spec create
[user.hostname] replication spec create *> set name=locked-spec-2
[user.hostname] replication spec create *> set objectSpecification.objects=Untitled/dbname
[user.hostname] replication spec create *> set targetHost=example.delphix.com
[user.hostname] replication spec create *> set targetPrincipal=admin
[user.hostname] replication spec create *> set targetCredential.password=delphix
[user.hostname] replication spec create *> commit
`REPLICATION_SPEC-4
[user.hostname]> replication spec select locked-spec-2
[user.hostname] replication spec 'locked-spec-2'> get
type: ReplicationSpec
name: locked-spec-2
automaticReplication: false
bandwidthLimit: 0
description: (unset)
encrypted: false
lockedProfile: false
numberOfConnections: 1
objectSpecification:
type: ReplicationList
name: (unset)
objects: Untitled/dbname
reference: REPLICATION_SPEC-4
runtime:
type: ReplicationSpecRuntime
schedule: (unset)
tag: e8608d05-0693-440d-8a2b-8c6cbfe06a62
targetCredential:
type: PasswordCredential
password: ********
targetHost: example.delphix.com
targetPort: 8415
targetPrincipal: admin
useSystemSocksSetting: false
[user.hostname] replication spec 'locked-spec-2'> update
[user.hostname] replication spec 'locked-spec-2' update *> set lockedProfile=true
[user.hostname] replication spec 'locked-spec-2' update *> commit
[user.hostname] replication spec 'locked-spec-2'> get lockedProfile
true
[user.hostname] replication spec 'locked-spec-2'>
To verify the locked status of a namespace, use the following.
[user.hostname]> namespace
[user.hostname] namespace> list
NAME
[user.hostname]-1
[user.hostname]-3
[user.hostname] namespace> select [user.hostname]-3
[user.hostname] namespace '[user.hostname]-3'> get
type: Namespace
name: [user.hostname]-3
description: (unset)
failedOver: false
locked: true <------------------------------ LOCKED
namespaceType: REPLICATION
reference: NAMESPACE-4
secureNamespace: false
tag: 5570be25-dbcf-48c3-b2d2-dd2c65eb98b7
[user.hostname] namespace '[user.hostname]-3'>
To verify that the namespace cannot be deleted or failed over, use the following.
[user.hostname] namespace '[user.hostname]-1'> delete [user.hostname] namespace '[user.hostname]-1' delete *> commit Error: Namespace "[user.hostname]-1" is locked and cannot be deleted. Action: Cannot delete a locked namespace. [user.hostname] namespace '[user.hostname]-1' delete *> discard [user.hostname] namespace '[user.hostname]-1'> failover [user.hostname] namespace '[user.hostname]-1' failover *> commit Error: Namespace "[user.hostname]-1" is locked and cannot be failed over. Action: Cannot failover a locked namespace. [user.hostname] namespace '[user.hostname]-1' failover *> discard
To verify that the replication profile cannot be deleted or modified, use the following. Objects can still be added to the replication profile.
[user.hostname]> replication spec [user.hostname] replication spec> select locked-spec-1 [user.hostname] replication spec 'locked-spec-1'> delete [user.hostname] replication spec 'locked-spec-1' delete *> commit Error: The replication profile is locked and cannot be deleted. Action: Select an unlocked profile to delete. [user.hostname] replication spec 'locked-spec-1' delete *> discard [user.hostname] replication spec 'locked-spec-1'> update [user.hostname] replication spec 'locked-spec-1' update *> set automaticReplication=true [user.hostname] replication spec 'locked-spec-1' update *> commit Error: The replication profile is locked and cannot be updated. Action: Select an unlocked profile to update. [user.hostname] replication spec 'locked-spec-1' update *> discard [user.hostname] replication spec 'locked-spec-1'> update [user.hostname] replication spec 'locked-spec-1' update *> set objectSpecification.objects=Untitled/dbname,Group:/Untitled [user.hostname] replication spec 'locked-spec-1' update *> commit [user.hostname] replication spec 'locked-spec-1'> update [user.hostname] replication spec 'locked-spec-1' update *> set objectSpecification.objects=Untitled/dbname [user.hostname] replication spec 'locked-spec-1' update *> commit Error: Objects cannot be removed from a locked replication profile. Action: Select an unlocked profile to update. [user.hostname] replication spec 'locked-spec-1' update *> discard [user.hostname] replication spec 'locked-spec-1'>
To create a replica retention policy and apply it to the locked namespace, use the following.
[user.hostname]> policy
[user.hostname] policy> createAndApply
[user.hostname] policy createAndApply *> set policy.type=ReplicaRetentionPolicy
[user.hostname] policy createAndApply *> set policy.duration=6
[user.hostname] policy createAndApply *> set policy.durationUnit=YEAR
[user.hostname] policy createAndApply *> set target=Namespace:/[user.hostname]-1
[user.hostname] policy createAndApply *> set policy.name="Six Years"
[user.hostname] policy createAndApply *> get
type: PolicyCreateAndApplyParameters
policy:
type: ReplicaRetentionPolicy (*)
name: Six Years (*)
customized: false
duration: 6 (*)
durationUnit: YEAR (*)
target: Namespace:/[user.hostname]-1 (*)
[user.hostname] policy createAndApply *> commit
`POLICY_REPLICA_RETENTION-30
[user.hostname] policy>
To verify that the replica retention policy cannot be deleted or modified, use the following.
[user.hostname] policy> select POLICY_REPLICA_RETENTION-30 [user.hostname] policy 'Six Years'> delete [user.hostname] policy 'Six Years' delete *> commit Error: The replica retention policy "Six Years" could not be removed because the target namespace "[user.hostname]-1" is locked. [user.hostname] policy 'Six Years' delete *> discard [user.hostname] policy 'Six Years'> update [user.hostname] policy 'Six Years' update *> set duration=4 [user.hostname] policy 'Six Years' update *> commit Error: The replica retention policy "Six Years" could not be modified because the target namespace "[user.hostname]-1" is locked. [user.hostname] policy 'Six Years' update *> discard [user.hostname] policy 'Six Years'> unapply [user.hostname] policy 'Six Years' unapply *> set target=Namespace:/[user.hostname]-1 [user.hostname] policy 'Six Years' unapply *> commit Error: The replica retention policy "Six Years" could not be removed because the target namespace "[user.hostname]-1" is locked. [user.hostname] policy 'Six Years' unapply *> discard [user.hostname] policy 'Six Years'>