Db2 Cyber Recovery: Closing the Recovery Point Gap

Closing the Gap: IBM Z® Cyber Vault and IBM® Db2® Recovery Expert Pro for z/OS®

An unplanned outage can devastate business continuity. Enterprises do everything they can to prevent this. With the current abundance of AI and access to domain expertise for everyone, potential attacks can become more sophisticated than ever, and companies work hard to stay ahead. IBM Z® Cyber Vault is IBM’s approach to increasing the protection level of mainframe customers, enhancing cyber resiliency, and enabling System Z® ecosystems to minimize data loss through proven, repeatable recovery processes.

How IBM Z Cyber Vault Protects Production Data

IBM Z Cyber Vault is a well-understood concept by now. Production volumes are captured as immutable, point-in-time Safeguarded Backups on IBM DS8000® storage arrays that can’t be compromised by bad actors. GDPS Logical Corruption Protection Manager and IBM Copy Services Manager orchestrate capture and restore. An isolated, air-gapped Recovery LPAR allows you to IPL an LPAR using previously created Safeguarded Backups. On this isolated Recovery LPAR, you can validate the state of your production system and perform forensic analyses in case you need to determine the optimal point in time to restore your production system to after a cyberattack.

If a bad actor gains elevated access to a mainframe environment and finds a way to compromise your z/OS® system, for example by encrypting datasets with ransomware, a Safeguarded Backup can be used to restore a production system to an earlier point in time. This enables business operations to resume as quickly as possible. However, any updates made between the last Safeguarded Backup and the start of the attack are likely to be lost. The decision a business has to make when restoring normal operations is between losing updates to production since the last clean Safeguarded Backup was created or not being able to restore production systems at all.

If the decision is made to restore production to a previously created Safeguarded Backup, all updates to the entire environment between the creation of the Safeguarded Backup and the point in time when the attack started are lost by default. For example, if a Safeguarded Backup is created every 3 hours and the last one was created at 9:00 a.m., a ransomware attack that starts at 11:52 a.m. may require restoring production to 9:00 a.m. All transactions and updates made between 9:00 a.m. and 11:52 a.m. to the entire environment would be irreversibly lost.

Technically, all updates to Db2® for z/OS between 9:00 a.m. and shortly before the attack started are available as Db2 log data. However, log data generated after the last clean Safeguarded Backup (9:00 a.m.) is not available in the Cyber Vault by default.  

This scenario is shown in Example 1:

Understanding the Recovery Point Gap

This is where IBM Z Cyber Vault has a structural limitation, and it is one that shows up when a continuously updated system of record, such as Db2 for z/OS, is involved. Reverting Db2 for z/OS to a prior point in time would almost always result in losing all committed transactions (or more precisely: all units of recovery) since the last Safeguarded Backup.

For a batch-driven system, that may be acceptable. For a payments engine, a core banking system, or a claims platform, it is not. The alternative, taking copies more frequently, consumes backup capacity and does not scale indefinitely.

That interval between Safeguarded Backups creates a recovery point gap. Db2 for z/OS already keeps the information needed to close it in its logs. After a cyber event, however, those logs may be corrupted, deleted, or simply unreachable from an offline or untrusted production environment.

Closing the Gap with IBM Db2 Recovery Expert Pro for z/OS

To allow for a Db2 for z/OS roll-forward recovery to reduce the data loss window from multiple hours to a few minutes or less, the collection of the following Db2 for z/OS assets is required:

• Copies of the Db2 bootstrap data set.
• Copies of new archive logs.
• Copies of image copies that have been created after LOG NO events (e.g., LOAD REPLACE LOG NO).

If image copies aren’t created after LOG NO events, objects may not be recoverable.

IBM Db2 Recovery Expert Pro for z/OS collects these assets in definable intervals. The collection interval should align with the organization’s service-level agreement (SLA) and resulting recovery point objective (RPO) in case of a catastrophic event such as a ransomware attack.

To protect these additionally collected assets from potential corruption during a cyber event, they must be stored on immutable storage, similar to Safeguarded Backups. IBM Db2 Recovery Expert Pro for z/OS stores these assets on immutable storage and supports the following storage options:

• An additional Logical Corruption Protection (LCP)-managed Safeguarded Copy session within an IBM DS8000 Disk Array. This is the same storage solution that contains your regular Safeguarded Backups and is the recommended option.
• IBM Virtual Tape Server TS7700.
• Private or public S3 Object Storage.

Between scheduled Safeguarded Backups (during normal production operations), IBM Db2 Recovery Expert Pro for z/OS continuously captures interim Db2 archive logs, copies of Db2’s Bootstrap Dataset, and image copies created after LOG NO events (such as LOAD REPLACE LOG NO) and preserves them outside the production environment on immutable storage. When recovery is needed, the last validated Safeguarded Copy is restored into Cyber Vault’s Recovery LPAR. Those additionally captured data assets are restored by IBM Db2 Recovery Expert Pro for z/OS to the same Recovery LPAR, and Db2 for z/OS will automatically be recovered to the selected point in time between snapshots, typically just shortly before the corruption happened. The frequency at which archive logs are written determines how close you may actually get to the point in time when the attack started. It is important to note that customers are responsible for determining the point in time to roll Db2 for z/OS forward to. This point in time would be determined during a prior forensic analysis.

Considering Example 1 and assuming that additional recovery assets would have been collected and stored on immutable storage every five minutes, Db2 for z/OS could be rolled forward to 11:48 a.m. This would reduce the RPO to four minutes before the cyber event occurred, compared to 2 hours and 52 minutes following the traditional Cyber Vault recovery approach.

Beyond reducing data loss, IBM Db2 Recovery Expert Pro for z/OS automates the manual steps involved in subsystem roll-forward recovery, helping organizations resume operations more quickly.

The recovery sequence in practice

Together, IBM Z Cyber Vault and IBM Db2 Recovery Expert Pro for z/OS provide a coordinated approach to restoring a clean production environment while minimizing potential data loss. The recovery process involves the following steps:

1. Cyber Vault captures Safeguarded Copies on the agreed schedule.
2. Db2 Recovery Expert Pro captures interim log data and image copies continuously into protected storage.
3. Corruption or intrusion is detected, typically by IBM zSecure Detection, a SIEM, or an operations team responding to application symptoms.
4. The most recent validated copy is restored into an isolated Recovery LPAR.
5. Forensic analysis in the vault identifies what changed and when.
6. The subsystem is rolled forward using interim logs to the selected point in time.
7. Assuming a wide blast radius, as in the event of a successful ransomware attack, all Db2 for z/OS objects would be returned to production in a non-corrupted state. Where the damage is a small number of identifiable transactions, transaction-level undo may be the faster path. This would be more along the lines of a ‘traditional’ recovery scenario, which is also supported by IBM Db2 Recovery Expert Pro for z/OS.

Steps 4 through 7 are where recovery time is won or lost, and they remain heavily dependent on individual expertise.

Why this matters beyond the technical claim

Beyond the technical recovery process, this approach has broader implications for organizations managing mission-critical Db2 environments, particularly in three areas: recovery objectives, regulatory compliance, and reliance on specialized expertise.

Recovery point objectives improve without creating more snapshots. Reducing the exposure window by shortening the copy interval comes with additional storage costs. 

Regulatory pressure is specific about recovery windows. DORA in the EU, and comparable expectations elsewhere, require organizations to demonstrate that critical services can be restored within defined limits, and to evidence testing rather than assert capability. Non-disruptive recovery rehearsal matters as much here as the recovery itself.

Dependence on scarce expertise is reduced, not eliminated. Db2 subsystem recovery after a cyber event is currently a small-population skill in most organizations, and it is exercised rarely. Encoding the sequence in policy-driven orchestration makes the outcome less dependent on which small number of people happen to be reachable. It does not remove the need for those people to design, validate, and supervise the process.

Strengthening Cyber Resilience

IBM Db2 Recovery Expert Pro for z/OS 1.1 addresses a specific, well-defined weakness in the Cyber Vault pattern: the transactions stranded between two Safeguarded Backups. For organizations that have already invested in IBM Z Cyber Vault and run mission-critical workloads on Db2 for z/OS, it is a targeted improvement that can be introduced incrementally and proven through rehearsal before being trusted.

Based on customer feedback, Db2 for z/OS is often the most important data store for resuming normal operations after a cyberattack. The need to minimize data loss during recovery served as the north star for the development of IBM Db2 Recovery Expert Pro for z/OS and its subsystem roll-forward capabilities.

IBM Z Cyber Vault and IBM Db2 Recovery Expert Pro for z/OS help IBM System Z customers build cyber resilience, reduce cyber risk, and protect sensitive data.