Data Protection: Ensuring Data Availability

423 Pages·2020·36.863 MB·English

by  Preston de Guise

Data Protection

Data Protection
Ensuring Data Availability
Preston de Guise
[second] edition published [2020]
by CRC Press
6000 Broken Sound Parkway NW, Suite 300, Boca Raton, FL 33487-2742
and by CRC Press
2 Park Square, Milton Park, Abingdon, Oxon, OX14 4RN
© 2020 Taylor & Francis Group, LLC
CRC Press is an imprint of Taylor & Francis Group, LLC
Reasonable eforts have been made to publish reliable data and information, but the author and publisher cannot assume responsibility for the validity of all materials or
the consequences of their use. Te authors and publishers have attempted to trace the copyright holders of all material reproduced in this publication and apologize to
copyright holders if permission to publish in this form has not been obtained. If any copyright material has not been acknowledged please write and let us know so we may
rectify in any future reprint.
Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmitted, or utilized in any form by any electronic, mechanical, or
other means, now known or hereafter invented, including photocopying, microflming, and recording, or in any information storage or retrieval system, without written
permission from the publishers.
For permission to photocopy or use material electronically from this work, access www.copyright.com or contact the Copyright Clearance Center, Inc. (CCC), 222
Rosewood Drive, Danvers, MA 01923, 978-750-8400. For works that are not available on CCC please contact [email protected]
Trademark notice: Product or corporate names may be trademarks or registered trademarks, and are used only for identifcation and explanation without intent to infringe.
ISBN: 978-0-367-47410-2 (hbk)
ISBN: 978-0-367-25677-7 (pbk)
ISBN: 978-0-367-46349-6 (ebk)
Typeset in Garamond
by Deanta Global Publishing Services, Chennai, India
For my husband, Daz, my father, Peter, and my mother, Lynne

Contents
Preface ...............................................................................................................................................................................xix
Acknowledgments ..............................................................................................................................................................xxi
1 Introduction ........................................................................................................................................................ 1
1.1 Te Value of Data ..............................................................................................................................................1
1.2 Te Lay of the Land ..........................................................................................................................................3
1.3 What Are You Doing Here? ...............................................................................................................................3
1.4 What’s Changed in the Datacenter? ..................................................................................................................4
1.5 What Is Data Protection? ..................................................................................................................................4
1.5.1 Data Protection as a Security Activity ...................................................................................................4
1.5.2 Data Protection as a Privacy Activity ....................................................................................................6
1.5.3 Data Protection as a Storage/Recovery Activity ....................................................................................7
1.6 Key Challenges ..................................................................................................................................................9
1.6.1 Te Rise of Unstructured Data .............................................................................................................9
1.6.2 Big Data ................................................................................................................................................9
1.6.3 Cloud ..................................................................................................................................................10
1.6.4 Virtualization ......................................................................................................................................10
1.6.5 Containers and Functions ...................................................................................................................10
1.6.6 Data and Systems Complexity ............................................................................................................11
1.6.7 Te Law ..............................................................................................................................................11
1.6.8 Crime ..................................................................................................................................................11
1.7 A Brief History of Data Protection ..................................................................................................................12
1.8 Te Miserly Hoarder .......................................................................................................................................14
1.9 Summary .........................................................................................................................................................16
1.10 Self-Refection .................................................................................................................................................18
Personal Data ...................................................................................................................................................18
Business Data ...................................................................................................................................................18
2 Contextualizing Data Protection ...................................................................................................................... 19
2.1 Introduction ....................................................................................................................................................19
2.2 Data Classifcation...........................................................................................................................................20
2.2.1 What Is the Data? ...............................................................................................................................20
2.2.2 Where Is the Data? .............................................................................................................................21
2.2.3 Who Uses the Data? ...........................................................................................................................22
2.2.4 When Is the Data Used? .....................................................................................................................22
2.2.5 How Is the Data Used? .......................................................................................................................22
2.2.6 Summarizing Data Classifcation ........................................................................................................23
2.3 Protection Methodology ..................................................................................................................................23
2.4 Protection vs Regeneration ..............................................................................................................................24
2.5 Organizational Change ...................................................................................................................................25
2.6 Summary .........................................................................................................................................................25
2.7 Self-Refection .................................................................................................................................................26
vii
viii ◾ Contents
3 Data Lifecycle .................................................................................................................................................... 27
3.1 Introduction ....................................................................................................................................................27
3.2 Understanding Copy Proliferation ...................................................................................................................29
3.3 Archiving and Deleting ...................................................................................................................................32
3.4 Summary ........................................................................................................................................................ 34
3.5 Self-Refection ................................................................................................................................................ 34
4 Elements of a Protection System ........................................................................................................................ 37
4.1 Introduction ....................................................................................................................................................37
4.2 People ..............................................................................................................................................................37
4.2.1 Designers ............................................................................................................................................37
4.2.2 Operators ............................................................................................................................................38
4.2.3 End Users ............................................................................................................................................38
4.2.4 Data Protection Team .........................................................................................................................39
4.3 Training ..........................................................................................................................................................39
4.4 Documentation and Processes ........................................................................................................................ 40
4.4.1 Design ................................................................................................................................................41
4.4.2 Implementation .................................................................................................................................. 42
4.4.2.1 System Confguration Guide ............................................................................................... 42
4.4.2.2 System Map ........................................................................................................................ 42
4.5 Testing .............................................................................................................................................................43
4.5.1 Type Testing .......................................................................................................................................43
4.5.2 Informal vs Formal ............................................................................................................................ 46
4.5.2.1 Test Procedure .....................................................................................................................47
4.5.2.2 Test Register .........................................................................................................................47
4.5.2.3 Test Schedule .......................................................................................................................47
4.5.3 Performance Testing ...........................................................................................................................47
4.5.4 Test Risks ............................................................................................................................................49
4.5.5 Automated Testing ..............................................................................................................................50
4.5.6 What Is a Test?....................................................................................................................................52
4.6 Service Level Agreements ................................................................................................................................52
4.7 Technology ......................................................................................................................................................53
4.8 Summary .........................................................................................................................................................53
4.9 Self-Refection .................................................................................................................................................54
5 IT Governance and Data Protection ................................................................................................................. 55
5.1 Introduction ....................................................................................................................................................55
5.2 Architecture .....................................................................................................................................................55
5.2.1 Te FARR Model of Data Protection ..................................................................................................56
5.2.1.1 Fault Tolerance .....................................................................................................................56
5.2.1.2 Availability ...........................................................................................................................56
5.2.1.3 Redundancy .........................................................................................................................58
5.2.1.4 Recoverability ......................................................................................................................58
5.2.1.5 Tying the FARR Model Together .........................................................................................59
5.2.2 Data Protection Architect (DPA) ........................................................................................................60
5.3 Service Transition ............................................................................................................................................61
5.4 Change Management ......................................................................................................................................63
5.5 Summary .........................................................................................................................................................63
5.6 Self-Refection .................................................................................................................................................63
6 Monitoring and Reporting ................................................................................................................................ 65
6.1 Introduction ....................................................................................................................................................65
6.2 Monitoring ..................................................................................................................................................... 66
6.2.1 Security and Privacy ...........................................................................................................................67
Contents ◾ ix
6.2.2 Health .................................................................................................................................................68
6.2.2.1 Drive Failures and Recovery Time .......................................................................................68
6.2.2.2 Broader Uses of MTBF and MTTR .....................................................................................69
6.2.3 Capacity ..............................................................................................................................................69
6.2.3.1 RAID/Data Storage .............................................................................................................69
6.2.3.2 Snapshots .............................................................................................................................70
6.2.3.3 Replication ...........................................................................................................................70
6.2.3.4 Backup and Recovery ...........................................................................................................71
6.2.4 Performance ........................................................................................................................................72
6.2.5 Notifcations versus Dashboards .........................................................................................................72
6.3 Reporting ........................................................................................................................................................73
6.3.1 Reporting via Aggregation of Monitoring ...........................................................................................74
6.3.2 Reporting for Trending and Predictive Planning ................................................................................74
6.3.3 Automated Reporting .........................................................................................................................75
6.4 Summary .........................................................................................................................................................75
6.5 Self-Refection .................................................................................................................................................76
7 Business Continuity .......................................................................................................................................... 77
7.1 Introduction ................................................................................................................................................... 77
7.2 Business versus IT Functions .......................................................................................................................... 77
7.3 Risk versus Cost ..............................................................................................................................................78
7.4 Planning Data Protection Strategies and Service Level Agreements .................................................................79
7.5 Summary .........................................................................................................................................................82
7.6 Self-Refection .................................................................................................................................................83
8 Data Discovery .................................................................................................................................................. 85
8.1 Introduction ....................................................................................................................................................85
8.2 What Will Be Protected? .................................................................................................................................85
8.3 Data Gravity ....................................................................................................................................................87
8.4 Shades of Data .................................................................................................................................................87
8.5 Indexing ..........................................................................................................................................................88
8.6 Summary .........................................................................................................................................................89
8.7 Self-Refection .................................................................................................................................................89
9 Security, Privacy, Ethical, and Legal Considerations ........................................................................................ 91
9.1 Introduction ....................................................................................................................................................91
9.2 Security and Privacy ........................................................................................................................................92
9.2.1 Logging ...............................................................................................................................................93
9.2.2 Encryption ..........................................................................................................................................93
9.2.3 Access Controls ...................................................................................................................................94
9.2.3.1 Multi-tenancy ......................................................................................................................94
9.2.3.2 General User Controls ..........................................................................................................96
9.2.3.3 Security Ofcers versus Service Administrator .....................................................................97
9.2.3.4 Do You Trust Trusted Access? ..............................................................................................97
9.2.4 Standard Security Controls .................................................................................................................97
9.2.4.1 Hardening Protocols ............................................................................................................97
9.2.4.2 Secure Physical Access ..........................................................................................................98
9.2.4.3 Physical Data transport ........................................................................................................98
9.2.5 Secure Erasure ....................................................................................................................................98
9.2.6 Privacy Considerations ........................................................................................................................99
9.3 Ethical Considerations...................................................................................................................................100
9.3.1 Performance of Duties ......................................................................................................................101
9.3.2 Custodians of Data ...........................................................................................................................101
9.3.3 Implications of Non-Protection .........................................................................................................102