Zero Trust With Commvault Backup Solution and PowerScale

• Overview
• Solution Components
• Solution Deployment Diagram
• Solution Configuration Steps Job Integrated Pre-Backup Script
• Create the Zero Trust API Configuration
• Commvault Console - Add Pre-Backup Script to a target
• Solution Results Integrated Pre-Backup Script
• Configuration of Integration with Workflows

Overview

How can Zero Trust improve your backup security?   With integrated backup repository automated immutable snapshots.  Your backup infrastructure is mission critical and the bad actors are targeting your backup hosts.   This solution guide will explain how to configure the Zero Trust API and integrate with Commvault to ensure a point in time recovery at the disk level exists automatically.  This solution enhances protection by:

1. Creating a rollback point Before any job runs to backup corporate data.  This is accomplished using a httpClient workflow in Commvault and leverages Superna’s Zero Trust api to create critical snapshots on the PowerScale storage where the backup data is stored
2. Key Integration
   1. Integrated job pre-Processing snapshots to protect the target backup data and allow rollback if a cyber attack or disaster impacts backup hosts.
   2. Create snapshots via workflows and integrate NAS target storage into workflows
3. Optional - integrate with endpoint protection systems or IDS IPS systems to monitor attacks over the network targeting your backup infrastructure and create pro-active automatic immutable snapshots of your backup data.

Solution Components

1. Commvault Command Center
2. Ransomware Defender for PowerScale
3. Ransomware Defender Zero Trust API license
4. PowerScale Storage used as Library over SMB or NFS protocol

Solution Deployment Diagram

Solution Configuration Steps Job Integrated Pre-Backup Script

4. Create an SMB share to store backup data example create an SMB share Commvault on path /ifs/cvMedia
5. Create a PowerScale Backup Library in Commvault Control Center
6.  
7.    
8. This will be used to backup data to PowerScale for all clients.

Create the Zero Trust API Configuration

1. Create the Zero Trust API authentication token
   1. Login to Eyeglass as admin
   2. Main Menu select Eyeglass REST API
   3. Click create token and enter commvault
   4. Save this api key
2. Get the curl command for Zero Trust Integration
   1. Select API Explorer tab
   2. Paste into the token field
   3. Scroll down to the Ransomware Defender v2 API's
   4. click the try out button (note this will create a snapshot for any critical paths that are configured)
   5.  
   6. Copy the curl syntax to a file to be used in steps later on.

Commvault Console - Add Pre-Backup Script to a target

Solution Results Integrated Pre-Backup Script

1. Run the configured host backup job
   1. Review the job execution to verify the script runs without error.  
      1. NOTE: If a previous job has called the zero trust api and snapshots already exist, the return code will be non zero indicating no need to create a new snapshot.   
      2. To suppress this you can simply set the 2nd line of the zerotrust.cmd with exit 0,  this will ensure no warnings are listed on backup jobs
   2. Commvault job log shows the pre-backup script ran with return code 0 indicating data snapshot was created through Ransomware Defender Zero Trust API.
   3. 
      
2. check the eyeglass job, running jobs view to see the api reached eyeglass
   1. 
      
3. done

Configuration of Integration with Workflows

1. Execute the Workflow
2. Review the recent jobs view in Eyeglass
3. Login to the PowerScale and verify the new Critical Paths snapshot
4. What happens if another job runs, will it create another snapshot?
   1. The zero trust api has a hold of timer that blocks additional snapshots from being created until the timer expires.  This ensures that too many snapshots are not created on the critical paths.
   2. The default hold-off timer is 1 hour, which means a maximum of 1 snapshot is allowed to be created per hour. Each snapshot has an expiry set for 4 hours and it will auto delete itself.
5. How to change the default expiry on critical path snapshots.
   1. See the guide here.
   2. Commvault Control Center Workflow configuration

9. 
   
   Create a new workflow.  The following workflow:
   - Creates a snapshot using the HttpClient
   - Monitors Backup Progress
   - Sends an email on backup success.
   

Integrating Superna Zero Trust Critical Paths
*Requires valid cert.  Follow commvault procedure for importing self signed certificates:
https://documentation.commvault.com/11.24/expert/116142_adding_commvault_certificate_to_java_keystore_on_http_proxy_servers_with_self_signed_certificate.html

a. Add the HttpClient to your Workflow
b. Create Workflow Variables
string URI https://<igls.fq.dn>/sera/v2/ransomware/criticalpaths
string api_key <igls_criticalPaths_api_key>
string data {}

c. Configure HttpClient Inputs
Post: xpath:{/workflow/variables/URI}
Headers:
 Accept application/json
 Content-Type application/json
 api_key xpath:{/workflow/variables/api_key}

10. Save and Deploy the Workflow
11. The new Workflow is now available to be executed from the Workflow menu
    
12. Done.  Ready for Zero Trust.