Ascend Capital, LLC INFORMATION TECHNOLOGY DOCUMENTATION. Abacus Group, LLC

Transcription

1 Ascend Capital, LLC INFORMATION TECHNOLOGY DOCUMENTATION Abacus Group, LLC June 18, 2015

2 CONTENTS ABACUS TECHNICAL SUPPORT CONTACT INFORMATION... 2 CLIENT SUPPORT HOURS... 2 PROBLEM REPORTING ABACUS HELPDESK... 2 SUPPORT ESCALATION... 2 TECHNOLOGY AND NETWORK OVERVIEW... 3 HIGHLIGHTS... 3 DATA CENTERS... 3 ENVIRONMENTAL DESIGN... 4 PHYSICAL SECURITY... 5 NETWORK SECURITY... 5 WIDE AREA NETWORK... 5 NETWORK DIAGRAM... 6 INFRASTRUCTURE TECHNOLOGY DIAGRAM... 7 INFRASTRUCTURE TECHNOLOGY SERVICES ARCHITECTURE... 8 INTERNET ACCESS X7 NETWORK MONITORING... 8 DISASTER RECOVERY... 9 STORAGE SOLUTIONS... 9 VMWARE HIGH AVAILABILITY (HA)... 9 MULTI-SITE REPLICATION MULTI-SITE BACKUP AND RESTORE DATA RETENTION SCHEDULES & INSTANT MESSAGE ARCHIVING GLOBAL RELAY ARCHIVING SERVICE OVERVIEW GLOBAL RELAY FEATURES & FUNCTIONALITY BUSINESS CONTINUITY INTERNET AND/OR NETWORK IS UNAVAILABLE POWER OUTAGE IN OFFICE OFFICE BUILDING IS INACCESSIBLE Abacus Group LLC [1] Confidential

3 ABACUS TECHNICAL SUPPORT CONTACT INFORMATION CLIENT SUPPORT HOURS Ascend is provided with information technology services and support by Abacus Information Technology, LLC (Abacus) between the following business hours: Monday to Friday: 6am 6pm Pacific Time, and after hours on an as needed basis Saturday and Sunday: On an as-needed basis PROBLEM REPORTING ABACUS HELPDESK The Abacus Helpdesk will be Ascend s primary point of contact. In the event of a hardware / software issue, Ascend will contact the Abacus Helpdesk for assistance resolving the issue. helpdesk@abacusgroupllc.com Phone: SUPPORT ESCALATION Mike Herman Director - Client Technical Services Phone: mherman@abacusgroupllc.com Mike Herman Director Client Technical Server Phone: mherman@abcusgroupllc.com Abacus Group LLC [2] Confidential

4 TECHNOLOGY AND NETWORK OVERVIEW Abacus has built an adaptive infrastructure to provide the most reliable and scalable computing environment possible. Abacus has partnered with leading technology vendors such as Network Appliance, Cisco, Microsoft, Dell and VMware to deliver IT services to customers at a fraction of the cost of doing it themselves. Leveraging industry best practices for hosting services, the Abacus Group delivers secure and robust access to mission critical applications such as , File, ActivSync / BES and Database servers/services. HIGHLIGHTS Advanced anti-spam technology leveraging machine learning from Postini Multi-level anti-virus solutions from Symantec Enterprise level storage solutions powered by Network Appliance Highly Redundant network and firewall Infrastructure from Cisco Systems Tier III data centers provided by Sungard and Internap. DATA CENTERS Abacus has high-performance data centers that are designed to be secure, highly available, scalable and manageable. The network infrastructure is built using Cisco routers, switches and firewalls. The following are the details of the data centers utilized for Abacus s IT platform (AbacusFLEX). Primary Data Center Abacus hosts Ascend s primary IT infrastructure at the Digital Realty Trust Data Center located at 720 2nd Street, Oakland, CA The facility is an 111,000 square foot Tier III data center located near Jack London Square in Oakland, California. Built in 2001, the data center is located in the region s fiber-rich district next to a PG&E substation. The facility is owned and operated by Digital Realty Trust Inc. The data center is certified to the highest industry standards and compliance requirements including: 24/7/365 power, cooling, connectivity and security capabilities to ensure mission-critical operations and business continuity for tenants. Secondary Data Center (Disaster Recovery) Abacus concurrently replicates and hosts Ascend s secondary / disaster recovery IT infrastructure at the Sungard Availability Services Data Center located at 1500 Spring Garden Street, Philadelphia, PA The facility is a 1,080,544 square foot Tier III data center. The data center is certified to the highest industry standards and compliance requirements including: 24/7/365 power, cooling, connectivity and security capabilities to ensure mission-critical operations and business continuity for tenants. Abacus Group LLC [3] Confidential

5 ENVIRONMENTAL DESIGN The Primary Data Center is located at a Tier-III Co-Location facility and is designed with very stringent environmental and power requirements: Continuous power supply with backup uninterruptible power supply utilizing CPS Hitec systems: Adequate power capacity including air conditioning and lights Hitec systems tested at full load on monthly schedule Fuel for generators (72 hours worth) kept on premises and monitored for local environmental compliance Conforms to or exceeds applicable local structural building codes utilizing standards such as bullet proof glass, fire doors and reinforced walls and complying with disaster proof design: Complies with all local zoning ordinances Certified not located in a 100-year flood plain Earthquake and hurricane bracing on all racks and cable trays (where appropriate) Adequate multi-zone air conditioning, including a backup system for the multizone air conditioning: Climate control including humidity sensors and control. Designed to provide cooling for 150W per/sq.ft. Heat and smoke detectors that meet or exceed all local fire code regulations. Very Early Smoke Detection Alarm (VESDA) Double pre-action sprinkler system Pre-action dry pipe system zoned to release water only where needed Easily removable access panels in raised flooring Flood sensors and monitoring under raised floors and in other critical areas Separate grounding systems to prevent grounding loops; true ground versus green wire ground Sealed cable vault entrances to facility, remotely monitored Formalized physical facility preventive maintenance program -- Facility is SAS70 Type II Certified Sub-breakers per relay rack or lineup CPS systems clean all power before it enters the building to protect against any power fluctuation. Abacus Group LLC [4] Confidential

6 PHYSICAL SECURITY The Primary Data Center is located at a Tier-III Co-Location facility which has very stringent physical security requirements: Building access procedures: Limited number of building entrances in compliance with local fire ordinance Access limited and managed via security policies for all facility entrances 24x7 onsite security guards Visitor-logging procedure Card-key, biometric, or similar entry locks ID-badge system for all employees and visitors Staff and visitors must wear badges at all times on premises Individual cabinet locks; master in NOC; key list from customer Equipment location: Video surveillance and motion sensors for entrances into and out of the building Locked cages Secure rooms available Managed firewall services with 24x7 monitoring available Backup lighting systems for entry ways and cable vaults Individual cabinet locks; master in NOC; key list from customer NETWORK SECURITY All three locations (Client Site, Primary Data Center and Secondary Data Center) will be protected by best in class Cisco ASA firewalls deployed in a failover configuration. Remote access will be encrypted via Cisco VPN or Citrix. Client domains will be segregated on separate VLANs. Industry best practices will be utilized to ensure that security patches are deployed on a regular basis through WSUS update servers. Group policy will enforce security standards on workstations and laptops. Symantec Anti-Virus will protect against emerging virus and spyware threats. will be scanned before entering the network for malware. Spam will be filtered and quarantined based on individual user preferences. WIDE AREA NETWORK Data Centers are interconnected using multiple high-speed links in order to provide high performance, scalability and redundancy. Using a dynamic routing protocol (e.g. OSPF), the network can detect link and router failures; quickly finding an alternate best path and rerouting the traffic accordingly. Abacus Group LLC [5] Confidential

7 NETWORK DIAGRAM Abacus Group LLC [6] Confidential

8 INFRASTRUCTURE TECHNOLOGY DIAGRAM Abacus Group LLC [7] Confidential

9 INFRASTRUCTURE TECHNOLOGY SERVICES ARCHITECTURE AbacusFLEX utilizes three components to provide Ascend with a secure, redundant and scalable network. 1) Ascend s site hosts an ESX server to provide multiple VMs supplying Domain controller functionality (DNS, DHCP, AD), file/print services, and utility services such as WSUS (Windows Server Update Services) and monitoring. Through this configuration, the client experiences no latency when accessing files and critical services. 2) The Primary Data Center hosts a clustered Exchange farm utilizing CCR (clustered continuous replication) to provide highly available messaging. Additionally, BlackBerry Enterprise servers are configured for failover to DR. The ESX servers, at the production data center, host virtual instances to provide redundancy for all critical applications. 3) The Secondary Data Center provides fail-over capabilities in the event there is a regional disaster and the client site and/or primary / production data center are not available. All data from the client site is replicated to the secondary data center such that there will be minimal loss of data in the event the client site and primary data center are inoperable. INTERNET ACCESS Each client site is connected to the production data center through their primary circuit (bandwidth to be determined by local infrastructure and availability). Client Internet traffic routinely flows over this line and through the production data center's dual 100 Mbps DIA (Direct Internet Access) lines. These circuits are multi-homed through BGPv4 with Cogent Communications and Internap allowing automatic failover in the event of an Internet Service Provider failure. Additionally, each client site has a DIA line of varying size. Through dynamic routing (OSPF) traffic will automatically reroute around failed network devices or down circuits. This design provides the highest level of resiliency and minimizes downtime during hardware and/or link failures or any routing issues within the Service Provider s networks. 24X7 NETWORK MONITORING All components of our network are monitored 24x7 by our Network Management Systems. Enterpriselevel network monitoring applications not only detect faults in real-time but can inform of potential problems before they occur. Performance metrics from all routers and switches are collected and analyzed to determine abnormal device/traffic behavior that could have a negative impact on the performance of a customer s network. Abacus Group LLC [8] Confidential

10 DISASTER RECOVERY Abacus s Disaster Recovery service will be managed out of the Sungard Data Center in Philadelphia, PA. In the event of a local or regional disaster, data and applications will be available to users via Citrix. This service will allow Ascend s users to securely access their data and applications via any internet browser. The Abacus Disaster Recovery solution has been architected to allow for the failure of individual components without impacting Ascend or any of its users in regards to their use of the IT functions. All of the data and applications at the client site will be replicated to the secondary data center in Philadelphia, PA in near real-time ensuring minimal data loss in the event of a disaster. The primary data center in Oakland, CA will replicate the clustered Exchange mailbox servers to this site via near real-time SCR (Standby Continuous Replication) log shipping. Abacus provides multiple levels of DR planning to accommodate single points of failure and catastrophic outages. Clustered servers for zero downtime applications Highly available storage solutions with RAID technology Multi-level Snapshot capability to restore lost or corrupted data Multi-site replication for long term catastrophic failures Multi-site backup and restore of all files and databases using advanced tape library backup STORAGE SOLUTIONS Abacus s Storage Arrays provide extremely high reliability with redundant components and hitless upgrades ensuring that we can deliver 24x7-computing services. Based on a new virtualized model, data is written across as many as 40 disk drives, which improves performance and provides for instantaneous recovery of a drive failure using RAID or Mirroring techniques. VMWARE HIGH AVAILABILITY (HA) All Virtual Machines running in the Production and Secondary Data Centers are protected by VMWare's High Availability (HA) technology. This feature will automatically move and restart all virtual machines on a failed physical host. This technology significantly shortens downtime due to failed hardware. Abacus Group LLC [9] Confidential

11 MULTI-SITE REPLICATION Abacus Group's main hosting centers are geographically dispersed. The Primary Data Center is located in Oakland, CA. The secondary is in Philadelphia, PA. All data is replicated between each data center using advanced Microsoft and XOSoft replication technologies. MULTI-SITE BACKUP AND RESTORE Abacus Group uses Backup Exec to backup all databases, and files to secondary storage. Open files are backed up seamlessly, enabling backups to occur without interruption to critical business applications. Backups are configured to run automatically on a daily cycle. DATA RETENTION SCHEDULES All data will be backed up according to the retention schedule for each data type, as shown in the table below: DATA TYPE FREQUENCY RETENTION PERIOD File Data Daily 30 Days System Data Daily 30 Days Exchange Data Daily 30 Days SQL Data Daily 30 Days Abacus Group LLC [10] Confidential

12 & INSTANT MESSAGE ARCHIVING Ascend utilizes Smarsh s Archiving Solution for and Instant Message Archiving. Smarsh has developed an industry leading archiving solution to meet electronic communications regulatory mandates from the SEC and NASD (now FINRA). SMARSH ARCHIVING SERVICE OVERVIEW The Smarsh archiving service allows compliance officer(s) or designated reviewer(s) to monitor corporate communication with ease and intelligent functionality, as well as provide immediate access to missioncritical data stored in a secure Write-Once, Read Many format (WORM). The Web-based Smarsh management console enables reviewers to securely produce data on-demand and monitor all of the fund s electronic messages in one place. The system s rule-setting engine enables compliance personnel to search and retrieve messages within the archive based on customizable criteria, including random samples, keywords and phrases. The comprehensive Reporting Center is capable of producing customizable organizational usage reports and evidence of supervision/ policy enforcement. SMARSH FEATURES & FUNCTIONALITY The Smarsh s service provides Abacus clients with the ability to scan every single and instant message as it leaves or enters our Exchange server and/or the Instant Message clients of all of our employees. Through Smarsh Ascend is able to run keyword/phrase searches based on every field (or Boolean combination) associated with an or instant message. Ascend can also track chains of E- mails and s from multiple individuals. The service tracks message header information (where the originated or is sent), and demonstrates review policy enforcement with audit trail reports. Ascend is also able to save search criteria, and facilitate necessary review policy with regularly scheduled saved searches. Lastly, Ascend is able to define higher-risk users and assign appropriate scrutiny based on corporate policy, as well as configure company approved keyword lists for individual compliance officers/osjs Abacus Group LLC [11] Confidential

13 BUSINESS CONTINUITY In the event that one of the following scenarios occurs, please follow the appropriate steps to regain normal business functionality: INTERNET AND/OR NETWORK IS UNAVAILABLE Probability: Low Description: - Internet is unavailable - IM is unavailable - is unavailable - P drive is unavailable - Z drive is unavailable - Cannot log in to the domain Probable Source: This scenario may be caused by many potential sources possibilities include, but are not limited to - necessary configuration updates, router/switch failure, hardware failure, software corruption, patch requirements, virus infection, etc. Actions Needed: - Call the Abacus Helpdesk to alert of outage - The Abacus Helpdesk will troubleshoot with internal and/or external groups (if necessary) and advise of next steps SLA for Recovery: 2 hours or less (depending on the identified source) Abacus Group LLC [12] Confidential

14 POWER OUTAGE IN OFFICE Probability: Low/Medium Description: - Power in the building is available but no power in the office - No lights - Desktops are not functional - Network is functional - Phones are functional - Laptops are functional (running on battery) Probable Source: Various Actions Needed: - Call the Abacus Helpdesk to alert of outage - The Abacus Helpdesk will troubleshoot with internal and/or external groups (if necessary) and advise of next steps SLA for Recovery: In the event that this scenario occurs, the UPS will automatically kick in to generate power to the network equipment allowing the network and phones to remain unharmed. If you are using Cisco IP phones they most likely receive power from the UPS. It may be possible to remain in your office and continue normal business functions (via Wi-Fi and/or laptop). However it is advisable to work from a remote location until power is restored in the office Abacus Group LLC [13] Confidential

15 OFFICE BUILDING IS INACCESSIBLE Probability: Extremely Low Description: - Office building is inaccessible / unavailable Probable Source: In the event that this scenario occurs, it is likely that a catastrophic even has occurred in the region causing the building to become unavailable. Catastrophic events include: terrorism, acts of nature, fire, etc. Actions Needed: - Call the Abacus Helpdesk to alert of outage SLA for Recovery: The SLA for recovery will vary and is dependent on many factors. However, since all data is stored offsite, it is possible to resume normal business functionality by remotely logging in to the DR data center via Citrix. Abacus Group LLC [14] Confidential