The goal of a Virtual Vault is to create multiple snapsets of your data so that, if a cyber attack occurs, customers can analyze the snapsets to determine the point at which to restore data. An ancillary objective is to preserve the corrupted environment to understand the cyber attack and how it occurred. Here is one architecture that customers could evaluate and modify to meet their cyber needs. 

Virtual Vault using zDP at the secondary site

• Number of data centers: Two (DC1 and DC2)
• Storage: PowerMax (disk or DASD)
• Storage: DLm (virtual tape)
• Remote replication: SRDF/A
• Local replication: TimeFinder SnapVX with zDP 
• Management software on mainframe: Mainframe Enabler (MFE) Symmetrix Control Facility (SCF)

This design assumes that the workload at DC1 is production, where your mainframe environment and storage is running. Use SRDF/A to replicate the disk from primary DC1 to the secondary site (DC2).  

On the DC2 side (considered your backup and disaster recovery site), you would have a second mainframe environment running Mainframe Enabler SCF. On the DC2 mainframe environment running SCF, create a VDG within zDP with the following characteristics:

• The VDG must have all CKD volumes in the VDG definition.
• 288 snapsets are set at 10-minute intervals.

• This configuration gives you two days’ worth of recovery points to restore if a cyber event occurs.

• Within the VDG that is creating 288 snapsets, have a secure snapset created once an hour (accomplished with the skip five and secure the sixth snapset).

• This configuration gives you seven days of snapsets that you could restore from if a cyber event occurs.
• The SECURE attribute ensures that the snapset cannot be deleted.

DLm provides the ability to take data that might not be accessed regularly and send it to a public cloud (through S3) or private cloud (such as Dell ECS). DLm provides this ability through its Long Term Retention (LTR) functionality. For long-term data retention, leverage a DLm that is connected on your DC2 site, and use the DLm LTR feature. With this DLm environment, set up your daily backup jobs while keeping the data on virtual tape (or out to the cloud through the DLm LTR feature) for at least 30 days. Customers must determine how long to keep the data based on recovery requirements to maintain business operations and the amount of storage capacity needed to store that data. 

Figure 4.   Example of a Virtual Vault

This suggested architecture provides:

• Preservation of data, logs, and physical environment 
• Monitoring capabilities from a Mainframe Enabler, Unisphere, and CloudIQ perspective 
• Choice of what data to restore if a cyber event occurs