Abstract: Described is a system that securely recovers critical backup and data protection infrastructure such as a backup application that manages data for a backup and recovery system. Such a capability may be provided by securely storing a copy of metadata associated with a production backup application into an isolated recovery environment. By storing the metadata on the isolated recovery environment, the metadata may be secure from potential security threats such as ransomware that may attack the production infrastructure itself. Accordingly, the secure copy of metadata may then be restored to a sandboxed environment with the isolated recovery environment and used to create a recovery instance of the backup application. The system may also perform various tests on the recovered instance of the backup application in response to particular security threats before being exposed to a production system for recovery purposes.

Abstract: Described is a system that provides a mechanism to securely deliver software updates to components of an isolated recovery environment. More specifically, the system provides the ability to include (or inject) a software update as part of a secure data transmission from a production environment to an isolated recovery environment. The data transmission may use existing infrastructure for synchronizing recovery data between the production backup system and isolated recovery system thereby preventing a potential new access point (or vulnerability) to the isolated recovery environment that a cyber security threat may attempt to exploit.

Abstract: Described is a system for secure management of recovery data for data protection assets such as backup data and a backup application of a production backup system. The system may provide the ability to synchronize and secure critical recovery data of an isolated recovery environment. Accordingly, the system may reduce the breadth of potential cyber security attack vectors and increase the likelihood of efficiently recovering critical data and/or applications. To provide such capabilities, the system may only activate a data connection between a production system and a recovery system when synchronizing recovery data. In addition, the system may apply a retention lock to maintain a set of immutable copies of the recovery data and may restore the recovery data to a sandboxed environment where it may be tested and verified before being deployed to the production system as part of a recovery process.

Abstract: A method is used in managing data accesses in storage systems. An access path to a storage object is evaluated. The storage object is associated with a first storage processor of a storage system for providing access to the storage object. The storage object is accessed using a second storage processor of the storage system. The storage system includes source and destination storage pools configured such that performance characteristics associated with the source storage pool is different from performance characteristics associated with the destination storage pool. The storage object resides in the source storage pool associated with the first storage processor. Based on the evaluation, the access path of the storage object is changed to the second storage processor based on a policy. The policy determines available storage space in the destination storage pool associated with the second storage processor for migrating the storage object to the destination storage pool.

Abstract: A set of snapshots are stored for a first object. The first object uses a first logical unit number (LUN) to store data. The snapshots correspond to points-in-time that the first object may be rolled back to. A request is received for a directed rollback of the first object to a second object. The request specifies a particular snapshot of the set of snapshots. The second object uses a second LUN, different from the first LUN to store data. After receipt of the request, a discovery map of the second object is dynamically created. The discovery map specifies a storage stack associated with the second object that maps the second object to a physical storage device accessed through the second LUN. The directed rollback to a point-in-time corresponding to the particular snapshot is performed by obtaining, from the discovery map, the storage stack associated with the second object.

Abstract: In one example, a method for protecting data includes receiving input specifying a data backup process, consulting a resource map to identify backup resources that are available, and then checking a rules engine to identify a backup rule that matches the specified data backup process and that can be executed to perform a backup using the available backup resource. When a backup rule is identified that matches the specified data backup process and that can be executed to perform a backup using the available backup resources, the specified backup process is automatically performed using the identified backup rule.