IBM Storage security and Key differences in FlashSystem 5000 family

IBM Storage

1. IBM duomenų saugyklos
Duomenų saugumas įrenginio lygiu
Donatas Kudrevicius
Technical Sales Consultant
Arrow ECS Baltic

2. Internal
IBM Award-Winning Storage Portfolio

3. Internal
Family IBM Flash System
MIDRANGE
HIGH-END
ENTRY
Scalability
Performance
FlashSystem 9500FlashSystem 9500R
FlashSystem 7300
FlashSystem 5300
FlashSystem 5045
SAS
FlashSystem 5015
SAS
NVMe
NVMe
NVMe
NVMe

4. Internal
Tremendous performance
with improved predictability
More consistent I/O latency.
Significant improvements in real world performance.
1.3x enhancement in bandwidth.
Performance management is simpler.
Performance metrics
FlashSystem
5200
FlashSystem
5300
Improvement
Real world IOPS* 270,000 400,000 1.45x
Bandwidth - GB/s 21Gb/s 28GB/s 1.3x
*16k block size, 70% reads, 30% writes, and a 50% cache hit (numbers subject to change)

5. Internal
Key differences in FlashSystem 5000 family
FlashSystem 5015
2U height, AC or DC power
SAS control enclosure → 24x SAS SSD / 10k RPM HDD
or
SAS back-end → 12x NL-SAS HDD
2-core Broadwell DE CPUs
64GB cache max
4x 1GbE on-board ports
8x host ports max – 16Gb FC / 10GbE* / 12Gb SAS
2,048 volumes
2,048 FlashCopy mappings
4PiB FlashCopy capacity
Inline threat detection
FlashSystem 5300
1U height, AC power
NVMe control enclosure → 12x NVMe FCM4 / SSD / SCM
Inline compression with FCM
12-core Ice Lake CPUs with QAT
512GB cache max
4x 25/10GBE flexible on-board ports with options:
- SFP28, SFP+, RJ45
16x host ports max – 32Gb FC / 10GbE or 8x 64GbFC
8,192 volumes
15,863 Snapshots
10PiB Snapshot capacity
Inline threat detection + RTD
Encryption + Secure Boot
Volume Group Snapshots - Safeguarded copy, Internal
Scheduler
HyperSwap + PBHA
PBR
Storage Insights Integration
Embedded VASA Provider
Vvols replication
NVMe over FC or TCP
TCT
Powered by IBM Storage Virtualize
*25GbE will be WFM April 24
th
on FS5015/FS5045 due to supply constrains
FlashSystem 5045
2U height, AC or DC power
SAS control enclosure → 24x SAS SSD / 10k RPM HDD or
SAS control rnclosure → 12x NL-SAS HDD
6-core Broadwell DE CPUs
64GB cache max
4x 10GbE on-board ports
8 host ports max – 16Gb FC / 10GbE* / 12Gb SAS
8,192 volumes
8,191 Snapshots
4PiB Snapshot capacity
Inline threat detection
Encryption
Volume Group Snapshots - Safeguarded copy, Internal
Scheduler
HyperSwap

6. Internal
Storage Virtualize: a powerful software stack for modernization
Integrated
•FlashSystem 5015
•FlashSystem 5035
•FlashSystem 5200
•FlashSystem 7300
•FlashSystem 9500
•FlashSystem 9500R
Software Defined storage
integrated with storage
hardware
Appliance
•Heterogeneous storage
virtualization
•Consistent management
•Ultimate flexibility
•Participate in opportunities
where no storage sales exist
SAN Volume Controller
Software
Software Defined Storage
(SDS) In the Cloud
Removes Pain Points
Enables over 500 heterogeneous
storage systems to gain a wealth
of consistent features
•Brings consistent APIs to storage
•Easy Tier (AI-based tiering)
•All systems gain Compression
•All systems gain Deduplication
•All systems gain Encryption
•All systems gain Replication
•All systems gain easy Migration
Consistent management and
features to over 500 different
storage systems for on-prem
and in the cloud All systems gain a uniform portal to the cloud

7. Internal
Securing Your Data
Security and resilience is built into the FlashSystem Family from the ground up
Encryption
Hardware encryptionof data atrest
FIPS 140-3 Level 2 Certified*
Safeguarded Copy
Createimmutablepoint-in-timecopiesto
quicklyrecoverdata aftercyberattacks
Separationof dutiesfor prevention
Unauthorizedattemptsto deletecopies
Works on-premand in the cloud
Replication
Synchronous, asynchronous, asynchronouswith
changingvolumes, active-activecluster
Multi-factor authentication
Allowsadditionaluserauthenticationmethods
throughIBM Security Verifyand other
third-party providers

8. Internal
FlashSystem solutions include replication
IBM Storage Virtualize also has a periodic
asynchronous replication mode known as
Metro Mirror
Global Mirror
Global Mirror with Change Volumes
IBM Storage Virtualize provides synchronous replication known as
IBM Storage Virtualize provides asynchronous replication known as

9. Internal
FlashSystem solutions include encryption
Encryption of Data at Rest (EDaR)
•XTS-AES-256, as defined in the IEEE 1619-2007
•FIPS 140-2 Level 1 compliant
•Encryption with USB flash drives
•Encryption with key servers
Encryption of Data in Flight (EDiF)

10. Internal
FlashSystem solutions include snapshots
FlashCopy® function createsa point-in-time copy
Crash consistent - copy is created by the disk array, without stopping
the application
Application consistent - copy that synchronizes the operation of the
disk array (flashcopy mechanism) with the application

11. Internal
A breakthrough in cyber resilience

12. Internal
The power of early detection
Impact
Time
Recover
fastest
Respond
fastest
Primary Workloads
Fastest recovery from hours to minutes
Discover
fastest
2 days 3 days1 week2 weeks10 hoursSecondsMinutes Hours 3 weeks
An organization’s exposure from a cyber attack
Recovery with Ransomware Threat Detection as data is written and rapid recovery of data
IBM FlashSystem
Cyber Resilience

13. Internal
The layout of an industry
standard commodity SSD
Controller/Logic
Flash
This is a single card (IS SSD)
that is typically found in a 7mm
form factor. For large IS SSDs
they will routinely contain two
circuit boards.

14. Internal
The layout of S / M FlashCore Modules
NAND Flash
Magnetoresistive Random
Access Memory (MRAM)
DRAM
NAND Flash
Capacitors for Power Loss
Controller/Logic
U.2 Connector
Top Side Bottom Side

15. Internal
The impressive history of FlashCore Technology
2014
MicroLatency Module
Proprietary interface, single-
layer cell (SLC) flash, followed
up with multi-layer cell (MLC)
flash, and in both cases the
data path is in hardware
Multiple protection features,
including ECC error correction,
variable stripe RAID data
protection, overprovisioning,
and three-dimensional (AE3
flash modules) or two-
dimensional (AE2 flash
modules) flash RAID
2018
FCM1
NVMe interface, re-
implemented into a
standard 2.5” form
factor, triple-layer
cell (TLC) flash with
inline 2-to-1
data compression
and encryption with
no performance
penalty
2020
FCM2
NVMe interface, quad-
layer cell (QLC) flash
with better than TLC
performance, inline
2-to-1 data
compression and
encryption with no
performance penalty
2022
FCM3
NVMe interface, quad-
layer cell (QLC) flash
with SLC abilities,
optimized with a
“Hinting Architecture”
to optimize data
placement, with up to
3-to-1 inline
data compression,
encryption with no
performance penalty,
L and XL modules
based on PCIe G4,
2024
FCM4
NVMe interface, quad-
layer cell (QLC) flash with
SLC abilities, optimized
with a “Hinting
Architecture” to optimize
data placement, with up to
3-to-1 inline data
compression and,
encryption, with no
performance penalty, all
modules based on PCIe
G4, and Ransomware
Threat Detection

16. Internal
Ransomware Threat Detection With FlashCore Module
Compression Statistics
Encrypted payload
detection
Chi-Squared
LBA Addressing and
Sequencing Patterns
Changes in Read /
Write Throughput
Shannon Entropy
Processed on EVERY write with ZERO performance impact!
16
30+ data statistics analysed in detection engine

17. Internal
Ransomware Monitoring Architectural Overview
IBM FlashCore Modules
IBM Storage Virtualize
AI Inferencing Engine
Granular data analytics
Trends / Summary
Learn From DataShow Real
-
Time
Data And Trends
Storage Insights Pro
External Tools
Responses / Actions
Volume Statistics
Responses / Actions
SOAR e.g. IBM
Storage Defender
© 2024 IBM Corporation
Reinforcement
learning

18. Internal
Can not be mapped to
a host
Immutable:
Can not be written or read
by an application
Protected Copies of production volumes
Thinly-provisioned, space efficient and point-in-time
Built on existing FlashCopy snapshot technology
Stored in a Safeguarded copy location:
•Uses either Child Pool technology or copy
resides in same pool as the source volume
•Logical separation from other volumes
•Capacity control
•Access restrictions (separation of duties)
Automatically created and
deleted based on a
predefined schedule
Protected Copies of Data: Safeguarded Copy (SGC)

19. Internal
External software (CSM)
runs on a client provided
Virtual Machine or x86
server (Java App)
Storage Virtualize
handles automatic
deletion of expired
backups internally
No external APIs on
delete for security
Safeguarded Policy contains the copy schedule
(frequency) and how long to keep each copy
(retention)
Copy schedule: Minutes, Hourly, Daily, Weekly,
Monthly
Retention time: X days
Safeguarded Copy Automation - IBM Copy Services Manager (CSM)
Coordinate and catalog copies across multiple clusters
Connects via SSH
and uses CLI as
Administrator user

20. Internal
Protecting the environment from ransomware
Ransomware threat detection looks for potential ransomware attacks
Storage Insights Pro analyzes FlashSystem IO statistics in real-time, looking for unexpected changes to IO patterns
FlashCore Module 4 technology makes this alerting even faster, giving earlier warning to stop any attack
Is there a potential ransomware attack happening?
Which volumes are being attacked?
Ransomware detection alerts
can be received by QRadar
QRadar, Defender or other SIEM software can
trigger workflows to lockdown an environment

21. Internal
IBM Spectrum Copy Data Management (SCDM)
Complete copy automation
Create copies
Snapshots, copies, clones
Track copies
Catalog
Refresh copies
Automated DR and
dev-test refresh
Use copies
Map LUNS, spin up systems
Transition copies
Test Prod
Test to production
Delete copies
Clean up

22. Internal
IBM CYBER VAULT
Automation of recovery processes
Recover Quick Data Recovery
Safe Recover Point
IBM Storage Defender
IBM FlashSystem
Protect
Isolated & Immutable
Snapshots (WORM)
IBM Cyber Vault
Detect
IBM Storage Sentinel
Automated Ransomware
Detection

23. Ačiū!
23
Donatas Kudrevicius
[email protected]
[phone]

24. Internal
IBM FlashCore

Technology
24
Default
read levels
Optimal
read levels
Read Calibration
Garbage Collection
Health Binning
Flash Chips
…
SLC
QLC
…
…
SLC/QLC
Tiering
Error Correction
FlashCore Modules (FCM)
•FlashCore Technology
drives FCM
•FCM are the core
building blocks for
all NVMe FlashSystem
storage arrays
NVMe-based
FlashSystem
At the Heart of Quad Layer Cell (QLC) Enablement
Characterization

25. Internal
1.
IBM FlashCore modules collect and analyse
detailed ransomware statistics from every I/O
with no performance impact
2.
IBM Storage Virtualize runs an AI engine on every
FlashSystem that is fed ML models developed by
IBM Research trained on real-world ransomware
The AI engine learns what’s normal for the system
and detects threats using data from FCM
3.
IBM Storage Insights Pro collects threat
information from connected FlashSystems, alerts
users and triggers SIEM/SOAR software to initiate
a response
Statistics are fed back to IBM to improve ML
models
IBM FlashSystem Ransomware Threat Detection Pipeline
IBM Storage
Virtualize
IBM Storage Insights Pro

26. Internal
Storage Virtualize delivers common capabilities
Storage System #1
▪Thin provisioning
▪Snapshots
▪Mirroring
Storage System #2
▪Thin provisioning
▪Flash Storage
▪Compression
Efficiency Features
▪Thin provisioning
▪I/O caching
▪Compression and Deduplication
▪Flash storage support
▪Easy Tier
▪Data migration
Protection and DR
▪FlashCopy
▪Active-Active Data Center
▪Synchronous Mirroring
▪Asynchronous Mirroring
▪Encryption
▪Hot Spare Node (SVC)
For All Of A
Client’s
Distributed
Storage