Enabling rapid cyber recovery for critical mainframe environments

Overview

Challenge

• Mitigate ransomware risks and facilitate DORA compliance by enabling rapid cyber recovery for mission-critical banking environments on the mainframe. 

Solution

• Introduced the Hitachi Mainframe Cyber Resiliency Solution to protect mainframe data with near-production immutable snapshot capabilities.

Outcome

• Accelerates system recovery from 7 days to 2 hours, while minimizing the potential for data loss in the event of an attack.

Challenge

One of the largest private data center operators in Austria, Raiffeisen Informatik has delivered corporate IT services for more than 50 years. The company’s client base includes the main institutions within the Raiffeisen Banking Group Austria, as well as external organizations in the banking and insurance sector.

Many of Raiffeisen Informatik’s clients depend on mainframe systems to deliver high availability and performance for mission-critical workloads such as their core banking systems. Protecting sensitive data and mitigating risk are top priorities for Raiffeisen Informatik, and the company has relied for many years on Hitachi Vantara to deliver rock-solid storage for its mainframe environments.

Werner Georg Mayer, Managing Director at Raiffeisen Informatik, says: “Many businesses see the mainframe as a bulletproof platform, but the truth is that even the most robust environments are still at risk of unplanned downtime. Whether it’s a ransomware attack or a corrupted database, our role is to plan for and mitigate the impact of those worst-case scenarios.”

With the Digital Operational Resilience Act (DORA) and other similar regulatory requirements coming into force globally, Raiffeisen Informatik set the goal of recovering its mainframe environments faster than ever. "DORA is a smart piece of regulation," says Mayer. "It reflects what up-to-date IT actually means, and what level of maturity we should be operating at. The interesting part is that it forces you to test against the actual worst case, not the comfortable one."

Johann Radakovits, Tribe Lead Mainframe at Raiffeisen Informatik, says: “With banking environments in particular, the big challenge for disaster and cyber recovery is that we are dealing with highly interconnected systems. Often, it’s not possible to recover a single corrupted file or database in isolation. Instead, we need to shut everything down and restore multiple systems one by one.” As a result, in the worst-case scenario where an attacker took down both of Raiffeisen Informatik’s data centers simultaneously, complete recovery from backup media would have taken approximately 7 days.

Mayer comments: “We've done almost everything we can to protect our data. Now we're preparing for the worst case. Not 'how do we keep them out', but 'how fast do we get back up'. That's a more radical mindset, and probably a more honest one.”

He continues: “Every CEO should be asking themselves: ‘Are my recovery objectives actually achievable?’ We had to be certain that we could restore mainframe services for our clients at the time we wanted. So, we engaged Hitachi Vantara to help us dramatically reduce our Recovery Time Objective.”

Solution

To help Raiffeisen Informatik achieve its disaster and cyber recovery objectives, Hitachi Vantara deployed the Hitachi Mainframe Cyber Resiliency Solution.

“Previously, we were using two Hitachi VSP 5500 arrays to provide storage for our mainframe systems across two production sites, with daily backups via IBM FlashCopy,” says Radakovits. “With the Hitachi Mainframe Cyber Resiliency Solution, we’ve added two additional VSP 5600 arrays equipped with high-speed NVMe flash storage. We use Hitachi Universal Replicator to copy production data to the third array, and Hitachi ShadowImage for Mainframe to create immutable snapshots of the same data on the fourth array.”

The architecture works in a staged pipeline. Production data is continuously replicated from the primary storage systems to a separate replication layer, which, in turn, produces immutable snapshots every two hours on a physically distinct storage system. The critical property is that these snapshots reside on storage that the mainframe cannot address. An attacker with full administrative rights on the production environment cannot see, alter, or delete them. Snapshots are additionally protected against deletion within their retention period — physically air-gapped and logically write-protected simultaneously.

Recovery is direct from the snapshot storage, not through a restore-and-copy operation onto production hardware. And because a snapshot captures every database and application at exactly the same moment in time, the entire application landscape comes back up already consistent — no reconciliation of half-completed transactions is required. This is what makes a 1–2-hour recovery possible, whereas a traditional restore would take days.

“We started with a big ambition: to create multiple backups per day to minimize data loss, and dramatically reduce our restore times,” says Mayer. “By partnering with Hitachi Vantara, that is exactly what we have achieved. As one of the first companies to deploy the Hitachi Mainframe Cyber Resiliency Solution, we knew that there would be challenges to overcome. But every step of the way, we had full commitment from Hitachi Vantara and a shared understanding of the urgency of the implementation project. Without Hitachi's support, the solution simply wouldn't have worked.”

Raiffeisen Informatik now performs regular tests to verify that its recovery capabilities are ready for a real-world scenario. 

“For testing purposes, we create an overnight copy of one of our production environments inside a logical partition on the mainframe, completely isolated from the external network,” explains Radakovits. “We then run the recovery and production environments in parallel, which enables us to verify that the recovery environment is functioning correctly with no disruption to our production environment.”

Outcome

Through its partnership with Hitachi Vantara, Raiffeisen Informatik has transformed its approach to disaster recovery and cyber resilience. Today, the company can fully restore its systems within as little as one or two hours—up to 99% faster than before.

“The Hitachi Mainframe Cyber Resiliency solution not only cuts our Recovery Time Objective, but it also helps strengthen our defenses against ransomware risks,” says Radakovits. “Even if we imagine a catastrophic scenario where both our primary and secondary environments are compromised, we will be able to use immutable snapshots to rebuild and restore our systems.”

Raiffeisen Informatik is leading the industry with its mainframe recovery capabilities. The company regularly shares recommendations and best practices with other organizations.

“With the Hitachi Mainframe Cyber Resiliency Solution, we are now in a very strong position when it comes to DORA compliance,” confirms Mayer. “Many organizations understand that their mainframe environments are under threat, and we get requests all the time to share our experience of working with Hitachi Vantara, Raiffeisen Informatik. At security events on these topics, you don't see anyone who has progressed as far as we have."

Looking ahead, Raiffeisen Informatik plans to continue its close collaboration with Hitachi Vantara. By continually upgrading and enhancing its technology platform, the company will further improve its recovery capabilities.

“Hitachi Vantara is a technology partner that truly understands risk,” says Mayer. “Their global reach and deep technical knowledge help us protect our clients in an ever-changing threat landscape. I strongly believe there will be many new opportunities for Raiffeisen Informatik and Hitachi Vantara to work together in the future.”