Quantum Active Vault & Scalar Ransom Block
Ransomware protection with an offline copy that stays in the library

An optional Scalar library feature that keeps tapes inside the library in a vault partition with no tape drives and no host connection, invisible to every application. On the Scalar i6000 and i7 RAPTOR, an export-redirect policy moves a tape the backup software exports into the vault instead of the import/export slots, so the software believes the tape has left the library; Quantum’s datasheet lists export redirect as not supported on the i3 and i6, where tapes are moved into the vault from the library GUI. Only library administrators can see or change vault partitions, and Quantum recommends protecting those accounts with multi-factor authentication.

Ransom Block partly ejects a magazine so the robot cannot pick the tapes in it until someone physically pushes the magazine back in. Because the magazine is only partly out, the barcode scanner can still read the labels, so you can audit that the tapes are present from anywhere. Quantum’s datasheet lists Ransom Block on the Scalar i3 and Scalar i6 only.

A software block on a magazine. Once a tape is in a blocked magazine, requests to move it, including into a drive, are refused. Tape Blocking can be switched on remotely but only switched off at the library’s local operator panel, and releasing the tapes means ejecting and re-inserting the magazine, so both need someone physically at the library.

Against a remote attacker, Quantum says Ransom Block protects tapes as securely as exporting them to a vault, with the advantage that their presence can be checked at any time. Its own brief also notes that Active Vault on its own leaves a small risk if the library itself were hacked. A vault inside the library does nothing against fire, flood or theft of the building, so in our view it complements an offsite copy rather than replacing one.

No. Quantum states that Active Vault works with any application and is transparent to it: on the Scalar i6000 and i7 RAPTOR the backup software performs an ordinary export and the export-redirect policy does the rest. On the i3 and i6, which do not support export redirect, an administrator moves tapes into the vault from the library GUI. Tapes can come back by an administrator action or by the Automated Media Return policy.

Yes, on libraries with Extended Data Life Management, an optional licence available on the Scalar i6, i6000 and i7 RAPTOR. EDLM scans vaulted tapes on a schedule, using drives whose external data ports are disabled so the vault stays sealed. Quantum notes EDLM is not used with tapes under Tape Blocking or Ransom Block.

Scalar libraries support application-managed encryption, library-managed encryption with Scalar Key Manager, or third-party key managers over KMIP, with AES-256 on the drives. Scalar Key Manager is FIPS 140-2 validated, runs as a high-availability pair of virtual machines on VMware, Hyper-V or KVM, and offers one key per tape, key reuse per tape, one key per partition or one key per library.