In a previous blog, we discussed how DataCore SANsymphony 10.0 PSP21 introduced immutable snapshots to help organizations protect critical recovery data against ransomware, accidental deletion, and unauthorized modification. By combining enforced retention periods with cryptographic integrity protection, SANsymphony enabled organizations to preserve snapshots in their original state, even against actions initiated by privileged administrators.
With the release of SANsymphony 10.0 PSP22, that protection now extends well beyond snapshots. Organizations can apply immutability directly to virtual disks and Continuous Data Protection (CDP) rollbacks, verify the integrity of protected data on demand, and introduce approval-based controls for changes to immutability settings. Together, these enhancements establish a more comprehensive immutability framework across SANsymphony’s storage and recovery capabilities, helping organizations strengthen cyber resilience while addressing growing data retention, governance, and compliance requirements.
Extending Immutable Protection Across Storage and Recovery Assets
A comprehensive recovery strategy typically involves several layers of protection. Snapshots preserve specific points in time, virtual disks contain critical application data, and Continuous Data Protection provides granular recovery capabilities by recording changes as they occur. Each serves a different purpose, but all can become important when an organization needs to recover from ransomware, data corruption, or an operational failure.
With PSP21, SANsymphony established immutable protection for snapshots. PSP22 broadens this protection to additional storage assets, allowing administrators to preserve virtual disks and CDP recovery points under configurable retention policies. These protected assets remain read-only while immutable, preventing modification or deletion through normal storage operations. SANsymphony also calculates cryptographic hashes to establish integrity seals, creating a reference against which protected data can subsequently be verified.
This expanded coverage is particularly valuable because recovery requirements vary depending on the incident. An organization may need to preserve a specific virtual disk for forensic investigation, retain a CDP recovery point before attempting restoration, or protect snapshots for longer-term retention. PSP22 enables these different assets to benefit from a consistent approach to immutability, rather than limiting that protection to one recovery mechanism.
Immutability for Virtual Disks
One of the significant additions in PSP22 is the ability to apply immutability directly to SANsymphony virtual disks, including single, dual, mirrored, and three-way configurations. Administrators can designate a virtual disk as immutable and specify its retention period, after which SANsymphony establishes read-only protection and initiates cryptographic hashing to create an integrity seal.
Once protected, the virtual disk cannot be modified, shortened, or deleted while immutability is enforced. This is especially useful when organizations need to preserve a storage volume in a known state, whether for investigation, validation, or retention purposes. Because an immutable virtual disk is read-only, the capability is intended for volumes whose contents must be preserved rather than actively written to by production applications.
The resulting protection extends immutability beyond point-in-time snapshots to the virtual disk itself, giving administrators greater flexibility in deciding which storage assets should be preserved against subsequent changes.
Protecting Recovery Points with Immutable CDP Rollbacks
Continuous Data Protection is another essential component of SANsymphony’s recovery capabilities. Unlike periodic snapshots, CDP continuously records changes to protected virtual disks, allowing administrators to select granular recovery points from the available history. This can be particularly important when recovering from logical corruption, accidental changes, or ransomware, where the precise point at which data was affected may not be immediately apparent.
SANsymphony now introduces the ability to make persistent CDP rollbacks immutable. When an administrator creates an immutable rollback, SANsymphony separates it from the source virtual disk and converts it into an independent, protected virtual disk. The rollback receives its own retention period, cryptographic integrity seal, and associated approval settings, ensuring that the selected recovery point can be preserved independently of subsequent changes to the original volume.
Consider an organization investigating a ransomware incident. Its IT team may identify a recovery point from before the suspected compromise and want to preserve that specific state while assessing recovery options. By creating an immutable CDP rollback, the team can retain the selected recovery point as a protected, read-only asset rather than leaving it dependent on the ongoing CDP history. This helps safeguard the selected data against accidental or unauthorized changes during the investigation and recovery process.
Verifying the Integrity of Immutable Data
Preventing changes to protected data is fundamental to immutability, but organizations also need a way to confirm that the data they have retained remains intact. This becomes especially important when preparing to restore critical systems, conducting integrity checks, or demonstrating that retained information has not been altered.
PSP22 introduces on-demand Seal Verification across immutable snapshots, virtual disks, and CDP rollbacks. When immutability is enabled, SANsymphony calculates a cryptographic hash of the protected asset and stores the result as its verification seal. Administrators can subsequently initiate Seal Verification, which recalculates the hash and compares it against the original stored value. A match confirms that the protected data remains unchanged, while a mismatch causes the verification to fail and the affected asset to be flagged as Tampered.
Importantly, a failed verification does not remove immutable protection. The affected asset remains read-only, preserving its state for further investigation. This distinction is significant because immutability and integrity verification serve complementary purposes: immutability prevents authorized storage operations from changing protected data, while Seal Verification provides a mechanism for detecting discrepancies between the current data and its original cryptographic seal.
For organizations maintaining critical recovery copies or data subject to retention requirements, this capability adds an important layer of assurance. Administrators can verify protected assets when required rather than relying exclusively on the fact that an immutability policy has been applied.
Strengthening Governance with Approval-Based Controls
While immutability protects data against modification, effective governance also depends on controlling how that protection can be changed. In environments with multiple administrators, sensitive workloads, or formal retention requirements, unrestricted control over immutability settings could undermine the very safeguards organizations are trying to establish.
SANsymphony PSP22 addresses this through approval-based workflows for immutable snapshots, virtual disks, and CDP rollbacks. When immutability is configured, administrators can designate approvers responsible for authorizing requests to revoke protection or extend retention before its scheduled expiry. A change request includes a reason and must pass through the configured approval process, creating separation between the person requesting a change and those authorizing it.
For example, if an administrator needs to revoke immutability before the retention period expires, the request is submitted for approval rather than immediately executed. The designated approvers can review and approve or reject the request, and the associated actions are recorded. If no approvers were designated when immutability was enabled, early revocation and retention extension are not permitted; protection must remain in place until the configured retention period expires.
This approach reduces the risk of unilateral changes to protected assets and introduces greater accountability for sensitive administrative operations. It is particularly relevant to organizations implementing separation-of-duties policies or seeking stronger controls around the retention and preservation of important business records.
Supporting Cyber Resilience and Compliance Requirements
The value of immutability extends beyond protecting individual recovery copies. Organizations increasingly need to demonstrate that critical information can be preserved, its integrity can be validated, and changes to its protection are subject to appropriate controls. These expectations are relevant to cybersecurity strategies as well as governance and regulatory frameworks such as NIS2 and DORA, where resilience, risk management, and operational controls play important roles.
By extending immutability across snapshots, virtual disks, and CDP rollbacks, SANsymphony PSP22 enables organizations to protect a broader range of storage assets against unauthorized modification or deletion. Cryptographic Seal Verification provides a means to confirm the integrity of those assets, while approval-based workflows help enforce separation of duties and accountability around protection changes. Together, these capabilities can support internal security policies, retention practices, audit requirements, and broader compliance initiatives.
Of course, immutability alone does not guarantee successful recovery or regulatory compliance. Organizations still need appropriate backup strategies, access controls, recovery testing, and incident response procedures. However, immutable storage assets provide a valuable additional safeguard by helping ensure that critical data and selected recovery points remain protected and verifiable when they are needed most.
Bringing It All Together
With SANsymphony, DataCore delivers a more comprehensive approach to data immutability, extending protection from snapshots to virtual disks and CDP rollbacks while adding integrity verification and stronger administrative governance.
For IT teams, this means greater flexibility in protecting critical storage and recovery assets, improved confidence in the integrity of retained data, and more control over changes to immutable protection. For organizations facing increasing cybersecurity threats and compliance obligations, these capabilities strengthen the storage layer as an important part of a broader cyber resilience strategy.
Ultimately, effective data protection is not only about having copies available for recovery. It is also about preserving their integrity, controlling their retention, and maintaining confidence that the data organizations depend on remains trustworthy.
Get a free trial of SANsymphony and see in action its data protection and cyber resilience capabilities.
