Tape libraries: a different type of virus protection.

Satan's Bug. The Ripper. The Predator. Sounds like the latest offering from a Hollywood B-movie director. These aren't slasher films but rather well-known computer viruses and their ability to wreak havoc on a computer system makes them an MIS director's nightmare.

It seems as if viruses are proliferating more rapidly than ever. According to the Computer Security Institute, these worms and bugs generated a total cost of $49.9 million to businesses in the U.S. alone last year.

While we scan e-mails and files like crazy and keep our antivirus software as current as possible, we just can't seem to keep these pests out of our computer systems. According to the Computer Security Institute, the monthly rate of computer virus infection in U.S. and European companies and organizations grew from 10 per 1,000 PCs in 1996 to 105 per 1,000 PCs last year. If your defensive measures are limited to antivirus software and firewalls, perhaps it's time to strengthen the line of defense. A midrange tape library not only provides great backup and restore but also can provide barriers to a virus attack by adding options to the overall protection strategy.

How Viruses Get Into Computer Systems

Defending against a virus requires understanding how it works. Viruses are not all the same. There are viruses, e-mail viruses, worms and Trojan horses, and hackers out there building these germs don't stick to a single type. For example, a recent virus making headlines was the MSBlaster worm. This small piece of software uses computer networks and security holds to replicate itself. A copy of the worm scans the network for another machine that has a specific security hole. It copies itself to the new machine using the security hole, and then starts replicating from there. Without getting too far into a basic discussion of a worm, it's important to remember that it remains alive and replicates until it is fully removed. If the primary backup system is a disk array, then there is no protection from the virus. The virus simply transfers itself to the disk backup and continues eating away at valuable data. What's more, the live virus can transfer to every other disk connected within the array.

Tape: A Stronger Line of Defense

Unlike disk arrays, a virus on tape cannot infect other data on that tape, nor can it spread to other tapes within the library. When an infected file is backed up onto tape, the virus goes into stasis and remains dormant. Tape technology, unlike disk or optical, makes a copy of the actual file and is not a part of the file system. A virus needs to be an executable file to do its damage and tape is not an active file system. The result is similar to having a photo of a bomb rather than a real one. It can't explode.

Tape Libraries: The Most Versatile Defense for the Dollar

The midrange tape library offers the most powerful, versatile and cost-effective data defense for the dollar. Designed for companies who have storage requirements of less than 100 cartridges or approximately 40TB of storage capacity, tape libraries are much more malleable than RAID or JBOD disk storage and offers not only versatile backup but one of the best forms of protection money can buy.

Tape libraries are particularly well suited for virus defense because they offer greater options and flexibility in defending against virus attacks. Within the tape library is a record of the system prior to the actual infection allowing MIS to restore the record to its previous pristine form. Infected data sets can be moved to a sterile environment for inoculation from the offending code without further impediments to the network or passing the infection along to other files. In addition, tape libraries permit selective restoration so only the infected files need be restored.

The versatility factor in a midrange tape library is not limited to just virus protection. It extends to the method of data backup. For instance, tape libraries offer multi-generational drives and interfaces itself. This allows MIS to leverage investments in existing drives while utilizing the latest technology, such as LTO-2 Ultrium tape drives. Libraries today offer partitioning, a feature that lets MIS break up the device into mini libraries. For example a library can be used to back up multiple departments like sales and accounting, which may have different storage requirements. With a midrange tape library, the entire backup is accomplished using a single device.

Density is another area where tape libraries are improving. Tape companies are packing more and more data capacity into tape drives and media, and achieving greater and greater density in tape libraries with minimal footprints. Some new mid-range tape libraries such as Exabyte's Magnum20, are packing up to 60TB into a 20u rack space. In a few years, that same 20u rack space will hold 100-200TB. This incredible amount of density is very appealing to MIS managers who are struggling to fit more storage and computing power into space that cannot expand due to physical limitations or budget restrictions

Tape libraries also perform well when it comes to cost per gigabyte of storage. A typical street price for a tape library with a 20-100 slot cartridge capacity is $.22/GB. By comparison, the street price per gigabyte for a disk array can run anywhere from $1 to well over $50, depending upon the JBOD or RAID hardware.

Tape Libraries Enable SAN Implementations

Many companies are looking to migrate to a storage area network (SAN) system. A tape library with Fibre Channel interfaces fulfill this corporate backup strategy by providing information delivery that enables large data transfers at very high speeds with minimal network protocol overhead. With tape libraries attached directly to the SAN, data requiring backup is sent through the SAN rather than the production network. Backups can take place more quickly because the Fibre Channel SAN moves data faster than with the typical Ethernet-based network. With data moving across the SAN rather than the production network, the network no longer bogs down during backups. This allows backups to take place at any time without impacting network users. If the SAN supports server-less backup, backups can take place even more quickly because server bottlenecks are eliminated.

A SAN also scores well on efficiency because capacity can be shared among all the devices on the SAN. Storage is no longer tied to specific servers and data can be directed to any backup device on the SAN that has the appropriate capacity. Just as backups can be sent to any tape drive on the SAN, recovery can take place from any tape drive. This allows an infected file to be remotely removed, effectively isolating the virus from any other data connected to the SAN. Data storage can be managed at a central location and recovery, even of infected files, can be controlled from a single console.

SANS also scale easily, so when additional backup resources are required, an administrator can hot-plug devices into the SAN without reconfiguring servers. Unlike the limited number of devices supported on a SCSI bus, the SAN can support enough backup capacity to meet the needs of the entire network. The most common Fibre Channel networks implemented today can support over a hundred devices. The Fibre Channel standard defines other configurations that can support thousands to millions of devices.

Virus Protection: Just One Part of a Disaster Recover Strategy

Whether formulating a strategy to protect against a Trojan horse or a Hurricane Isabel, virus protection is just one piece of a company's overall disaster recovery plan. Whatever the cause, physical damage to a disk drive is usually catastrophic. Any damage to one area of the disk renders the entire disk unusable and results in the loss of that important data. In contrast, unless a tape cartridge is burned beyond recognition or shredded to confetti, data will still be retrievable. The physical damage to a tape is isolated to a specific area. No wonder the airline industry uses tape in its black boxes instead of disk--its recoverable. These same factors are the reason why tape is the dominant technology in environments where data protection is a top priority.

Portability is critical in disaster recovery. Transporting tape cartridges to offsite storage is simple and comparatively inexpensive because of their compact size. This permits the tape to be scrubbed of the virus using a software program--such as Norton Antivirus--away from the network. Disk drives do not have the same portability due to size, weight, fragility and the need for special packaging to help the media withstand the rigors of being moved. Using disk for disaster recovery and archiving applications is simply not practical.

Many smaller companies are the biggest victims of virus attacks and suffer the worst from it. Typically, they don't have the resources of a Fortune 500 company for firewall protection. Disk arrays certainly have many advantages and when combined with tape delivers the most impenetrable line of defense. Even if a worm manages to get through the network, it can be stopped at the tape backup.

It seems that viruses are here to stay--at least for now--adding an important consideration to a company's overall disaster prevention and recovery plan. Adding midrange tape libraries to the overall backup and recovery strategy make sense from both protection and cost/performance perspectives. And that should help make any MIS person sleep a little easier at night.

www.exabyte.com

Kevin Chard is LTO product manager at Exabyte Corporation (Boulder, CO)