Kentucky Center for Resilient Information Systems

Background: The protection and resilience of the financial services sector is a top priority for the Department of the Treasury. Securing and protecting the nation's banking and financial data will require the development of new secure, remote, financial transaction backup storage systems. Research is required to better understand the parameters that impact data replication and security within the construct of the complex technological environment on which the financial sector depends upon. As technology changes, the protection of critical data must be advanced to adapt to new challenges and threats. Technologies that enable data to be transferred in real time, securely, over greater distances wi]] provide for better business continuity planning, protection against identity thieves, and decrease the likelihood of disruptions from both man made and natural disasters. While many commercial data replication products are available today, it has become evident that security requirements and transmission speeds require further analysis. Basic parameters such as applicable data volume and distance, expected data loss, and costs have yet to be fully benchmarked for prospective analysis by interested parties. In addition, many products are specific to a particular database, file system, or operating system, making it difficult to adapt to systematic changes and modifications, unforeseen capacity requirements, and/or adoptions of new systems. Additionally, an important consideration in business continuity planning is to create geographic diversity in that secondary operational locations should be sufficiently far from production sites so that primary and secondary locations are unlikely to be affected by the same event. This consideration generally must align with the goals of being able to recover operations quickly, being able to resume operations from a point just prior to the event without loss of a transaction, protection from cyber threats or attacks, and taking into account costs of operation and other organizational issues. Data replication approaches will be dictated largely by the distance between the primary and secondary sites, the amount of data to be replicated, and how elosely and frequently the two sets of data are to be kept synchronized. An additional important consideration is the security of the data transfer. Scope: The Office of Critical Infrastructure Protection and Compliance Policy received a mandate from the United States Congress to contract for a research project improving the resiliency of the financial sector to recover from disaster scenarios through development of new secure, remote, financial transaction backup storage systems. As directed by Congress, the research will be conducted to identify ways to transfer and replicate data over longer distances and to protect data from being manipulated or distorted. Research of commercially available locations, networks, and products to determine the parameters associated with data replication and database recovery activities is required. A test environment must be created that provides a single point of presence to replicate these conditions to determine real world data transmission capacity, setup times, error rates, security requirements, and costs. Computer operational sites separated by as much as a thousand miles, with databases in the terabyte range and commercial size servers need to be connected via commercial networks, including the Internet, to protect the customer, the transaction data, and data critical to ensure the continued operation of our nation's banking and financial institutions.