IBM Systems and TechnologySolution Brief

IBM Storwize V7000 Unified: Safeguarding your critical data Integration with Symantec or McAfee solutions for NAS delivers essential malware protection

Highlights●● ● ●Leverage scalable, high-performing

scanning and repair services to ensure data integrity

●● ● ●Capitalize on built-in storage technology for easy, tight integration with caching capabilities for faster processing

●● ● ●Manage network traffic and proactively handle damaged or infected files with flexible deployment options

●● ● ●Reduce implementation time and mitigate risk with pre-qualified antivirus solutions for network-attached storage (NAS)

●● ● ●Extend anti-malware protection with high-availability and disaster-recovery functionality

●● ● ●Manage growing business needs with ease while also consolidating NAS and SAN data on a single system

With today’s continuing explosive growth in information and data comes the need for storing data without the risk of compromising data integrity. On a smarter planet where instrumented, interconnected and intelligent devices constantly gather, generate and process information to build com-petitive advantages, organizations of all sizes not only need to improve their storage efficiency to meet growing business requirements, they also need to safeguard shared data from malware, viruses and other threats.

What’s needed is a cost-effective, scalable, high-performance storage solution designed for optimal efficiency—one that easily integrates with industry-leading antivirus software for NAS to help protect your storage environment and prevent malware from infecting the enterprise. The IBM Storwize® V7000 Unified is a virtualized storage system designed to meet these requirements, seamlessly integrating with antivirus software for NAS from Symantec or McAfee to deliver a comprehensive solution to safeguard your data from malicious threats. The Storwize V7000 Unified also consolidates block and file workloads into a single storage system for simplicity of management and reduced cost, and offers enter-prise-level capabilities to enhance data protection and storage efficiency.

Tight integration with leading antivirus solutionsVirus scanning is an integral part of the Storwize V7000 Unified—the system requires no additional code installation or license for enablement. To ensure easy integration and deployment, the Storwize V7000 Unified

2

offers a built-in antivirus connector along with scan configura-tion and management via either the system’s command line interface or its icon-driven GUI. The Storwize V7000 Unified has been thoroughly tested and qualified with Symantec AntiVirus for NAS and McAfee VirusScan Enterprise for Storage, confirming interoperability and compatibility to detect viruses, worms and Trojan horses in all Common Internet File System (CIFS) file types, including mobile code and compressed-file formats.

Symantec AntiVirus for NAS provides scalable, high- performance virus scanning and repair services to protect valuable data stored on NAS devices. The solution provides increased scanning performance and improved detection capa-bilities for protection against multi-blended threats. It can be installed on a variety of platforms and accessed by a variety of supported browsers.

McAfee VirusScan Enterprise for Storage can be installed on Microsoft Windows platforms to extend the proven technology of award-winning McAfee Enterprise VirusScan to the data center by providing real-time threat protection to mission- critical NAS environments.

Flexible options for scanning and repairing infected filesStorwize V7000 Unified works together with Symantec or McAfee solutions to protect data, as well as the enterprise infrastructure from damaging malware, stopping it before ever reaching mission-critical files on the NAS system. The Storwize V7000 Unified antivirus connector communicates with scan engines from both Symantec and McAfee using the Internet Content Adaptation Protocol (ICAP). This enables two types of scanning approaches along with additional configuration options to customize the deployment.

On-access scanThe most effective approach for detecting malware before it can compromise data is to check files when they are accessed or copied. In an on-access scan, files are immediately scanned when a user creates or attempts to access a file over the net-work. Storwize V7000 Unified opens a connection with the server-based Symantec or McAfee scan engine and then sends the file to the engine for real-time scanning. An uninfected file that passes the scan test is passed to the requesting user. If scan-ning discovers malware, the file is quarantined and repaired. The clean file is then sent to the Storwize V7000 Unified where it replaces the infected file in storage before access is granted to users. Only the original uninfected or repaired file is made available to the requesting user.

On-access scanning ensures that the most current virus signa-tures are used for scans in a manner that typically produces a negligible effect on system performance. The Storwize V7000 Unified connector caches antivirus scan attributes and time-stamps for each file to be used later in determining whether the file must be scanned or rescanned. If no new virus signatures have been released since a file’s previous scanning, the system does not scan again, enhancing performance. When new antivi-rus definitions are received and updated, each requested file is rescanned before it is made available to the user.

Bulk scanThis approach allows scanning of a subset of files on a file sys-tem or a part of a file system. A bulk scan typically is scheduled to run daily overnight or at another low-usage time defined by the administrator to accommodate the time required for potentially lengthy scans and to avoid creating heavy network traffic during peak processing times. Bulk scan eliminates the need to check individual files when they are accessed or copied. Even though new malware released between scans can escape detection and removal, bulk scanning remains a convenient solution for types of files that are less prone to malware attacks such as files that are static or created using the Network File System (NFS) protocol.

Solution BriefIBM Systems and Technology

3

Configuration options that make protection even more effectiveAntivirus configurations on the Storwize V7000 Unified can be defined and modified via the system’s easy-to-use graphical interface or through its command line interface. Administrators can modify configurations dynamically, on the f ly if needed, without the need to shut down or restart antivirus scanning services. Key configuration capabilities include:

●● ● File processing strategy: The Storwize V7000 Unified can be configured so that infected, non-repairable files can be quarantined and then manually or automatically deleted, notifying the user with the appropriate error message.

●● ● Load balancing and failover: The Storwize V7000 Unified can be configured with multiple scan engines to distribute and balance the scan workload. If one scan engine becomes unresponsive, the system’s antivirus connector automatically directs the workload to the engines that remain operational. One scan engine can be configured to support multiple Storwize V7000 Unified devices—or for robust failover, multiple scan engines can be configured to scan a single multi-terabyte storage device. A minimum of two scan engines are recommended for high availability.

Solution BriefIBM Systems and Technology

When a user attempts to access a malware-infected file, the Storwize V7000 Unified solution configured for on-access scanning automatically invokes processes for quarantine, repair and replacement before access is granted.

File on-access scanning and infection repair

1 . File accessed on Storwize V7000 Unified

2 . Files transferredto scan engine

3 . File scannedand infection

repaired

Symantec or McAfeescan engine

IBM StorwizeV7000 Unified

User

6. Userallowed

access to file

5. Infected filereplaced withrepaired file

4 . Repaired filereturned to Storwize

V7000 Unified

4

Anti-malware solutions designed for mid-size and enterprise operationsSymantec and McAfee solutions for protecting NAS provide real-time threat protection to mission-critical information stored and accessed by Storwize V7000 Unified users. Their ability to detect virus-infected files and take action—repair, isolate or delete as required—is built on advanced features designed for the needs of enterprise-level storage users and includes:

●● ● Advanced antivirus technology: Continuously blocks a widerange of viruses and malicious code threats, including those hidden in compressed files

●● ● Detection of unwanted programs: Finds hidden spyware programs that open security holes

●● ● Centralized management: Reduces overall cost and provides ease of management

●● ● Continuous protection: Automatically scans data when CIFS files are accessed or written to the Storwize V7000 Unified, unlike traditional approaches that scan only at predetermined intervals

●● ● Cost effectiveness: Supports connection to more than one Storwize V7000 Unified device

●● ● Rapid notification: Sends notification whenever a virus is detected, enabling recipients to react instantly to a virus outbreak

Extending data protection with leading technologiesBeyond malware, organizations with rapidly growing volumes of unstructured data face a number of challenges to keeping that data protected and available. So in addition to antivirus software support, the Storwize V7000 Unified offers a

comprehensive set of built-in technologies to promote business continuity and continuous access to NAS data. These enterprise-level data protection capabilities include:

●● ● Asynchronous replication for site-to-site protection and disaster recovery

●● ● File system and fileset level snapshots (up to 256 per file system)

●● ● File level cloning for providing a full copy of a file at better granularity

●● ● IBM Tivoli® Storage Manager integration for extremely fast and efficient backup and restore processes, and for policy-driven migration of files to an external disk or tape device

●● ● NDMP support to provide both full and incremental backup of files utilizing IBM and third-party storage management software

●● ● RAID support and redundant components for high availability

Data protection capabilities leverage the IBM Active Cloud Engine™, which is integrated into the Storwize V7000 Unified and can provide a high-speed scan of the source file system to determine files and directories that have been created, modified or deleted. By quickly identifying candidates for backup or disaster recovery, Active Cloud Engine can help improve data protection strategies.

Why IBM?IBM is committed to continuous improvement and seamless ap-plication integration to optimize business results and minimize time-to-value. Storwize V7000 Unified deployed with Symantec AntiVirus for NAS or McAfee VirusScan Enterprise for Storage provides enterprise-level data protection to meet today’s rapidly

Solution BriefIBM Systems and Technology

5

Designed for data protection and storage efficiency, the IBM Storwize V7000 Unified consolidates block and file workloads into a single storage system for simplicity of management and reduced cost.

growing storage needs. Its single-management interface sup-ports ease of use and management as its high-availability and fault-tolerance features support continued operations even in the face of a malware attack.

Options for real-time, on-access scanning or off-peak bulk scanning help ensure continued safe operations, while the ability of Storwize V7000 Unified to scale nondisruptively as needed, eliminates impact on performance or data access during either capacity expansion or file scanning and repair. Built-in,

high-availability features also ensure system operation without interruption for business environments that need data quickly and cannot tolerate data loss.

Features and capabilities built into Storwize V7000 Unified such as the consolidation of SAN and NAS storage in one system, a unified management GUI for both storage approaches, and nondisruptive data migration to ensure ongo-ing data protection, as the storage infrastructure grows, can help organizations manage infrastructure expansion while reducing IT complexity.

As a market leader in the storage industry, IBM can help you handle storage challenges by providing innovative technology, open standards, excellent performance, and a broad portfolio of proven storage software, hardware and solutions offerings—all backed by IBM’s world-class maintenance and support.

For more informationTo learn more about IBM Storwize V7000 Unified, please contact your IBM sales representative or IBM Business Partner, or visit: ibm.com/systems/storage/disk/storwize_v7000

For a list of high-quality solutions with our partner Independent Software Vendors (ISVs), including access to solution briefs and white papers, visit: ibm.com/systems/storage/solutions/isv

Additionally, IBM Global Financing can help you acquire the IT solutions that your business needs in the most cost-effective and strategic way possible. We’ll partner with credit-qualified clients to customize an IT financing solution to suit your busi-ness goals, enable effective cash management, and improve your total cost of ownership. IBM Global Financing is your smartest choice to fund critical IT investments and propel your business forward. For more information, visit: ibm.com/financing

Solution BriefIBM Systems and Technology

© Copyright IBM Corporation 2012

Systems and Technology Group Route 100 Somers, NY 10589

Produced in the United States of America

February 2012

IBM, the IBM logo, ibm.com and Storwize are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the web at “Copyright and trademark information” at ibm.com/legal/copytrade.shtml

Microsoft, Windows and Windows NT are trademarks of Microsoft Corporation in the United States, other countries, or both.

This document is current as of the initial date of publication and may be changed by IBM at any time. Not all offerings are available in every country in which IBM operates.

THE INFORMATION IN THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT ANY WARRANTY, EXPRESS OR IMPLIED, INCLUDING WITHOUT ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND ANY WARRANTY OR CONDITION OF NON-INFRINGEMENT. IBM products are warranted according to the terms and conditions of the agreements under which they are provided.

Please Recycle

TSS03098-USEN-00